figma-prod-checklist

# Figma Production Checklist ## Overview Complete checklist for deploying Figma API integrations to production, covering authentication, error handling, rate limits, monitoring, and rollback. ## Prerequisites - Staging environment tested and verified - Production PAT or OAuth credentials ready - Monitoring infrastructure available ## Instructions ### Step 1: Authentication & Secrets - [ ] Production PAT stored in secret manager (not env files) - [ ] PAT uses minimum required scopes (`file_content:read`, not `files:read`) - [ ] PAT expiry tracked (max 90 days) with rotation reminder - [ ] OAuth refresh token flow tested (if using OAuth) - [ ] Separate tokens for dev/staging/prod - [ ] No tokens in client-side code or git history ### Step 2: Error Handling - [ ] All HTTP status codes handled (400, 403, 404, 429, 500) - [ ] `Retry-After` header honored on 429 responses - [ ] Exponential backoff with jitter for transient errors - [ ] Max retry limit to prevent infinite loops - [ ] Graceful degradation when Figma is unavailable - [ ] Error responses do not leak token values in logs ### Step 3: Rate Limiting - [ ] Request queue with concurrency control (max 3-5 concurrent) - [ ] Batch node IDs in single requests (up to 50 per call) - [ ] Response caching for frequently accessed files (TTL: 60-300s) - [ ] Rate limit monitor with proactive throttling - [ ] No tight loops calling Figma API without delays ### Step 4: Monitoring & Health ```typescript // Health check endpoint asy...