# HFAPI.com — API integration review

This worksheet is an engineering aid, not a certification or a complete security audit.

## Credentials
- Keep tokens out of browser code, public files, screenshots, and logs.
- Choose the least permissions needed for the actual task.
- Separate development and production credentials.
- Record an owner and test revocation with a nonproduction token.

## Data and model behavior
- Use synthetic or approved fixtures during development.
- Review the selected provider, data path, retention, and allowed use.
- Minimize prompts and redact logs; define any necessary content retention.
- Validate output structure and task correctness separately.
- Treat retrieved content and model output as untrusted input.
- Gate tool actions through application-level authorization.

## Reliability
- Bound payload size, output size, queue depth, and concurrency.
- Establish a deadline, cancellation behavior, and retry budget.
- Do not blindly replay state-changing requests after uncertain outcomes.
- Test an invalid token, timeout, malformed response, partial stream, and unavailable model.
- Define a fallback with equivalent data-handling approval or fail explicitly.

## Review record
Task:
Model and provider:
Configuration revision:
Review date:
Owner:
Open issues:
Approved scope:
Rollback trigger: