attio-prod-checklist

# Attio Production Checklist ## Overview Systematic checklist for launching Attio API integrations in production. Covers the real failure modes observed in Attio integrations. ## Prerequisites - Staging environment tested - Production API token created with minimal scopes - Monitoring infrastructure available ## Instructions ### Phase 1: Authentication & Secrets ``` [ ] Production token created with minimal scopes (see attio-security-basics) [ ] Token stored in platform secrets manager (not env file on disk) [ ] Separate tokens for dev/staging/prod environments [ ] .env files in .gitignore [ ] No tokens in logs, error messages, or client-side bundles [ ] Token rotation procedure documented ``` **Verify:** ```bash # Confirm production token works curl -s -o /dev/null -w "%{http_code}" \ https://api.attio.com/v2/objects \ -H "Authorization: Bearer ${ATTIO_API_KEY_PROD}" # Must return 200 ``` ### Phase 2: Error Handling ``` [ ] All API calls wrapped in try/catch [ ] AttioApiError class distinguishes retryable (429, 5xx) from fatal errors [ ] Exponential backoff with jitter on 429 responses [ ] Retry-After header honored (Attio sends a date, not seconds) [ ] 5xx errors retried (Attio may have transient issues) [ ] 400/422 validation errors logged with request body for debugging [ ] 403 scope errors produce actionable log messages [ ] 404 errors handled gracefully (records can be deleted/merged) ``` ### Phase 3: Rate Limiting ``` [ ] Queue-based throttling implemen...