Skip to main content
Complete this checklist before sending production traffic with a chk_live_ key.

​
Credentials and access

  • Store live API keys in a secret manager. Do not place them in frontend code, source control or logs.
  • Confirm that the key’s endpoint-family scopes cover every model your integration calls.
  • Keep test and live keys separate in each environment.

​
Request reliability

  • Send a unique Idempotency-Key on every POST and reuse it only for retries of the same payload.
  • Handle 202 as a normal accepted response. Poll the returned job or receive a webhook.
  • Back off on 429 and honor Retry-After.
  • Persist Request-Id and the job ID with your own request record.

​
Media and results

  • Use presigned uploads for videos, batches and reusable media.
  • Treat asset URLs and IDs as opaque values.
  • Handle a successful empty result and low-confidence values in your application rules.

​
Validation and operations

  • Run your retry, failure and webhook tests with test mode.
  • Verify webhook signatures and deduplicate by Carhub-Event-Id.
  • Monitor failed and expired jobs, then retain the error code and request ID for support.
Keep the generated API reference close to your implementation. It is the definitive source for endpoint-specific parameters, response schemas and supported input formats.