This section outlines operational considerations and best practices for running a production integration with XFX APIs.

Before going live, ensure your system is designed to handle rate limits, retries, monitoring, and security requirements appropriately.

Rate Limits

Rate limits vary by endpoint type. Indicative market data and executable quote requests are subject to different limits.

Endpoint	Rate Limit	Burst Limit
Get market data (indicative, non-executable)	100 requests / minute	10 requests / second
Get quote (executable pricing)	60 requests / minute	5 requests / second

Idempotency and Retries

🚧
Coming soon
Detailed guidance on idempotency keys and retry strategies is in progress. Check back for updates.

Monitoring

We recommend monitoring the following metrics to ensure the health and correctness of your integration:

Quote-to-execution conversion rate
Average quote response latency
Failed trades (by reason)
API error rates by status code
Authentication and token refresh failures

Alerting

✅
Recommended alerts

Set alerts for elevated error rates

Monitor for abnormal trading volumes or patterns

Alert on repeated authentication failures or token expiration errors

These signals help detect integration issues before they impact trading or settlement.

Security

Credential Management

Store credentials in environment variables or a secrets manager
Rotate credentials periodically
Never commit credentials to source control
Use separate credentials for each environment (development, staging, production)

Token Security

Cache access tokens in memory
Do not persist tokens to disk
Implement automatic token refresh before expiration
Clear tokens on application shutdown or restart

Transport Security

Always use HTTPS in staging and production
Never send credentials or tokens over unsecured connections

Request Validation

Validate all request inputs before sending them to the API
Sanitize any user-provided values
Enforce internal limits (e.g. maximum trade size, allowed currency pairs)