Store authentication outside source code
Keep the token in an environment-backed server secret and give every request an explicit timeout.
Use resource IDs returned by the API
Create portfolios with POST /api/v1/portfolios and persist the returned portfolioId in your backend. The API key defines the ownership boundary.
Handle the response contract
Check the HTTP status before decoding success data. Errors use application/problem+json; metered success responses include credit cost and remaining balance headers.