> ## Documentation Index
> Fetch the complete documentation index at: https://developer.quickei.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Best Practices

> Guidelines for a production-ready integration

Follow these guidelines to build a secure, reliable, and maintainable integration.

## Security

<CardGroup cols={2}>
  <Card title="Always use HTTPS" icon="lock">
    All API requests must use HTTPS. HTTP requests will be rejected.
  </Card>

  <Card title="Protect your keys" icon="key">
    Store API keys in environment variables or a secrets manager. Never commit them to version control.
  </Card>

  <Card title="Verify webhooks" icon="shield-check">
    Always validate the `X-Quickei-Signature` header before processing webhook events. See [Webhooks](/pos-api/07-webhooks).
  </Card>

  <Card title="Rotate credentials" icon="rotate">
    Regenerate your API keys periodically and after any suspected compromise.
  </Card>
</CardGroup>

## Reliability

<Steps>
  <Step title="Use idempotency keys">
    Include a unique `idempotency_key` when creating orders to prevent duplicate transactions if a request is retried.
  </Step>

  <Step title="Implement retry logic">
    Use exponential backoff for transient errors (429, 5xx). Start with a 1-second delay and double it on each retry, up to a maximum of 30 seconds.
  </Step>

  <Step title="Handle token expiry">
    Access tokens expire after 10 minutes. Implement automatic token refresh before expiry rather than waiting for a 403 error.
  </Step>

  <Step title="Validate before sending">
    Validate amounts, currency codes, and required fields client-side before making API calls to reduce unnecessary requests.
  </Step>
</Steps>

## Monitoring

* **Log all API responses** — including successful ones — for debugging and audit trails
* **Monitor webhook delivery** — set up alerts for failed webhook deliveries
* **Track response times** — detect degradation early
* **Set up health checks** — periodically call a lightweight endpoint to verify connectivity

<Note>
  The Quickei API enforces a rate limit of **60 requests per minute** on the POS API. Design your integration to stay well within this limit during normal operations.
</Note>