Calling other systems from your application.
PRACTICAL RULES
Always set a timeout. An API call without one can hang until your page times out, making your site as slow as someone else's server. Handle failure. The service will be unavailable at some point; decide what your application does then. Cache responses where the data does not change often. Calling an API on every page load is slow and may exceed rate limits. Never call an external API during a page load if the visitor does not need the result immediately. Queue it.
CREDENTIALS
API keys belong in environment configuration, never in code, never in a repository.
Use separate keys for staging and production. A test order placed against live keys is an awkward conversation.
RATE LIMITS
Know them. Exceeding them typically results in temporary blocking, which looks like the service being broken.
LOGGING
Log failures with enough detail to diagnose, without logging the credentials.
OUTBOUND CONNECTIONS
Shared hosting permits outbound connections on standard ports. If a service uses an unusual port and connections fail, open a ticket and ask.
