Audit SDK retry and timeout defaults before adoption
Point a candidate client at a local stub that fails and hangs, then read its real retry count and tail latency off the stub instead of trusting its README.
How-to › Section 13
Operate integrations in production#
For the team with many third-party APIs in production: choosing and upgrading SDKs, credentials, telemetry and metering, one control surface for outbound calls, and debugging what went over the wire.
7 guides in 4 topics. Every guide compares its approaches and shows the output its commands printed.
- Evaluate, adopt and upgrade SDKs 2
- Load credentials and secrets 1
- Instrument and meter API calls 2
- Control outbound integrations from one place 2
Evaluate, adopt and upgrade SDKs 2 guides
Assessing an official, community or generated SDK before you depend on it (license, retry behavior, release cadence, transport control), wrapping it behind your own interface, pinning and vendoring, upgrading across a major with jscodeshift and ts-morph codemods, responding to Sunset headers, and using SDK Catalog packages for public APIs (install per language, offline test mode, the paired Go CLI, REPL and MCP server, direct and prepare for unmodelled endpoints, what unofficial means, and when Octokit or plain fetch is the better call).
Judge whether an unofficial SDK is safe to depend on
Run six checks over a candidate package before you add it, and separate the facts that should stop adoption from the costs you are choosing to take on.
Load credentials and secrets 1 guide
Where the secret lives and how code reaches it: environment variables and dotenv, Vault (agent and API), AWS Secrets Manager and Parameter Store, GCP Secret Manager, Azure Key Vault, 1Password Connect and CLI, Doppler, Infisical, SOPS, the external-secrets operator; rotation without downtime, local development, CI, serverless, failing fast on a missing secret, keeping secrets out of CI logs.
Load secrets in Lambda without a fetch per invocation
Read an API key from Secrets Manager once per execution environment, not per invocation, through the extension, the SDK, or sekreto, and count the calls.
Instrument and meter API calls 2 guides
OpenTelemetry traces and metrics for API clients (this branch owns the plumbing), trace context propagation from SDK through gateway to service, request ids and correlation, audit logs, cost attribution per call and per tenant, sampling, client identification headers, dashboards (Grafana, Honeycomb, Datadog), and SDK-level telemetry, metrics, audit, cost and clienttrack features (sdkgen) as one option against OpenTelemetry auto-instrumentation and gateway analytics.
Export outbound call spans from a serverless function
Get the span for the API call your function made to the collector before the environment freezes: flush it, hand it to a runtime task, or let a sidecar drain it.
Set an SLO for a third party API you depend on
Set an objective for a dependency you do not run, measured from your client, with burn-rate alerts that page when the provider degrades, not when you ship a bug.
Control outbound integrations from one place 2 guides
One place to see and police every outbound call: API gateways used for egress (Kong, Envoy, Tyk), egress proxies, service-mesh egress, unified-API vendors (Merge, Nango, Paragon), automation platforms (Zapier, Make, n8n), feature flags and kill switches, and station (each SDK registered as a plugin; config, credential routing via sekreto, observe, police with allow, deny and budget, debug; reading the station-errors reference when a policy denies a call; the sdkgen-station feature package, station-view, seneca-station).
Route outbound API calls through an egress proxy
Send every outbound call through one proxy that holds the credentials, enforces a per-vendor policy, and logs every decision it makes.
Tell a denied outbound call apart from a vendor outage
Work out in a minute whether your own egress policy, the network, or the vendor stopped a call, by making the denial an error code the caller can branch on.
Generate the client instead of writing it#
Retries, timeouts, pagination and auth are the same problems in every client. Voxgig generates them from your OpenAPI description, in 23 languages, from one model.