Store authentication outside source code

Use native fetch in a trusted Node or server runtime. The browser must call your backend, not ChainsFlow with a secret token.

Use resource IDs returned by the API

Create portfolios with POST /api/v1/portfolios and persist the returned portfolioId in your backend. The API key defines the ownership boundary.

Handle the response contract

Check the HTTP status before decoding success data. Errors use application/problem+json; metered success responses include credit cost and remaining balance headers.