> ## Documentation Index
> Fetch the complete documentation index at: https://docs.remapdb.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Best practices

> Run Remapdb API integrations with strong security, clear monitoring, and safe rollout control.

Use this page as your production standard before you rely on API access for customer-facing flows, backend automation, or MCP-based AI tool connections.

## Security baseline

* Keep API credentials on server-side systems only.
* Restrict credential visibility to approved team members.
* Use separate credentials per environment.
* Keep a documented credential-rotation process.
* Store MCP client API keys as `REMAPDB_API_KEY` in approved config, environment, or secret storage.
* Rotate immediately after any suspected leak.

<Warning>
  If you suspect a key leak, rotate credentials first. Investigation comes after containment.
</Warning>

## Reliability baseline

* Set request timeouts for every API call.
* Retry only temporary failures.
* Use exponential backoff with jitter.
* Cap retry attempts to avoid retry storms.
* Show a graceful fallback in your UI when requests fail.

## Monitoring baseline

For each request, log:

* endpoint path and method
* response status
* response time
* retry count
* service and environment name

Do not log:

* API secrets
* full auth headers
* sensitive personal user data

## Safe rollout process

<Steps>
  <Step title="Validate in staging first">
    Test request/response behavior with your staging credentials and staging environment.
  </Step>

  <Step title="Release behind a controlled rollout">
    Start with a small share of traffic before full rollout.
  </Step>

  <Step title="Watch live metrics">
    Monitor error rate, response time, and retry volume in real time.
  </Step>

  <Step title="Keep rollback ready">
    Be able to disable or roll back quickly if error rates rise.
  </Step>
</Steps>

## Remapdb-specific checks

* After any plan change, confirm API access is still active.
* After any website/domain change, re-test widget-related API requests.
* After credential rotation, confirm every backend, worker, scheduled job, and MCP client loaded new credentials.

## Go-live checklist

* Credentials are stored securely on the backend.
* MCP clients are configured only in approved environments, if you use [AI Integrations](/api/ai-integrations).
* Staging validation is complete.
* Monitoring and alerts are active.
* Usage budget alerts are configured.
* Rollback procedure is tested.

## Related actions

* [Credentials and authentication](/api/credentials-and-authentication)
* [AI Integrations](/api/ai-integrations)
* [Usage limits](/api/usage-limits)