Production Readiness

This section outlines operational considerations and best practices for running a production integration with XFX APIs.

Before going live, ensure your system is designed to handle rate limits, retries, monitoring, and security requirements appropriately.

---

Rate Limits

Rate limits vary by endpoint type. Indicative market data and executable quote requests are subject to different limits.

---

Idempotency and Retries

🚧

Coming soon

Detailed guidance on idempotency keys and retry strategies is in progress. Check back for updates.

---

Monitoring

We recommend monitoring the following metrics to ensure the health and correctness of your integration:

• Quote-to-execution conversion rate
• Average quote response latency
• Failed trades (by reason)
• API error rates by status code
• Authentication and token refresh failures

Alerting

✅

Recommended alerts

• Set alerts for elevated error rates
• Monitor for abnormal trading volumes or patterns
• Alert on repeated authentication failures or token expiration errors

These signals help detect integration issues before they impact trading or settlement.

---

Security

Credential Management

• Store credentials in environment variables or a secrets manager
• Rotate credentials periodically
• Never commit credentials to source control
• Use separate credentials for each environment (development, staging, production)

Token Security

• Cache access tokens in memory
• Do not persist tokens to disk
• Implement automatic token refresh before expiration
• Clear tokens on application shutdown or restart

Transport Security

• Always use HTTPS in staging and production
• Never send credentials or tokens over unsecured connections

Request Validation

• Validate all request inputs before sending them to the API
• Sanitize any user-provided values
• Enforce internal limits (e.g. maximum trade size, allowed currency pairs)