ship safely

keep trust on the server

• SecretsLoad BROK_API_KEY from a production secret manager. Never expose it to a client bundle.
• IsolationCreate separate keys per application and environment. Revoke keys during incident response.
• User inputValidate sizes, URLs, file types, and requested models before calling Brok.

timeouts and retries

• Set a timeoutUse 60 seconds for ordinary language requests and a workload-appropriate longer deadline for generation jobs.
• Retry selectivelyRetry 429 and temporary 5xx failures two or three times with exponential backoff and jitter.
• Avoid duplicate workDo not blindly retry media creation after an ambiguous timeout. Save the request ID and reconcile first.
• Stream correctlyForward chunks immediately and handle client disconnects without buffering the whole response.

prove production traffic

Record route, model, status, latency, input/output tokens, and x-brok-request-id in application logs. Compare them with Brok Usage. Before launch, test a success, invalid request, revoked key, timeout, streamed response, and retry path.