Store authentication outside source code

Keep the token in an environment-backed server secret and give every request an explicit timeout.

Use resource IDs returned by the API

Create portfolios with POST /api/v1/portfolios and persist the returned portfolioId in your backend. The API key defines the ownership boundary.

Handle the response contract

Check the HTTP status before decoding success data. Errors use application/problem+json; metered success responses include credit cost and remaining balance headers.