Store authentication outside source code
Java HttpClient keeps the dependency surface small; wrap it in one typed infrastructure adapter rather than calling it from controllers.
Use resource IDs returned by the API
Create portfolios with POST /api/v1/portfolios and persist the returned portfolioId in your backend. The API key defines the ownership boundary.
Handle the response contract
Check the HTTP status before decoding success data. Errors use application/problem+json; metered success responses include credit cost and remaining balance headers.