API Integration Patterns for AI Products

AI products fail at the edges: auth expiry, partial writes, and undocumented APIs. Treat integrations as production software. ## Patterns that work 1. **Webhook in, queue, worker out** - absorb bursts, retry safely 2. **Anti-corruption layer** - normalise third-party payloads before AI or CRM sees them 3. **Idempotency keys** - prevent duplicate tickets, charges, or CRM records 4. **Thin action gateway** - AI can only call approved tools with scoped auth 5. **Outbox / event log** - know what the system attempted and what succeeded ## Auth checklist - Short-lived tokens where possible - Secret rotation - Per-environment credentials - No secrets in frontend prompts or n8n exports shared loosely ## Testing Contract tests for critical payloads. Replay failed events. Shadow-run AI tool calls before enabling writes. ## Next step If your AI demo works until it touches billing or CRM, the integration layer is the real project. That is often where we start.