Core Concepts

Best Practices

Build secure, reliable and maintainable ALEFBA integrations.

Configuration

• Store the API base URL and credentials in environment configuration.
• Separate development, staging and production configuration.
• Never commit live secrets to source control.

Requests

• Use HTTPS and explicit timeouts.
• Send Accept: application/json.
• Use Content-Type: application/json when sending JSON.
• Validate identifiers and request data before sending.

Responses

• Check HTTP status codes before consuming response data.
• Ignore unknown additive fields.
• Handle empty, malformed and unexpected responses safely.
• Log sanitized diagnostics without credentials or customer secrets.

Reliability

• Use exponential backoff for retryable failures.
• Do not retry authentication and validation errors automatically.
• Make write operations idempotent where supported.
• Cache public catalog responses when operationally appropriate.

Security

• Authorize every seller resource independently of client input.
• Use least-privilege credentials.
• Rotate credentials after exposure or staff changes.
• Minimize retention of personal and marketplace-sensitive data.