Get ready for production

Plan the integration

• Decide which system owns each kind of record. When both your system and crmSeries edit the same field, pick one as the source of truth so updates don't overwrite each other.
• Choose one stable identifier from your system for each record, and keep a mapping between it and the crmSeries ID.
• Agree the dealership-specific values you'll send, such as branch codes, sales rep codes, statuses, and sources, with your crmSeries administrator.
• Estimate your volume and schedule. Spread bulk syncs out over time instead of sending every record at once, and run large jobs outside the dealership's business hours.

Secure your credentials

• Client secrets and API keys live in a server-side secret store, never in source control, browser code, mobile apps, or logs.
• Production and test credentials are stored separately, and your deployment can't mix them up.
• You know how to request a rotated credential from crmSeries, and can deploy a new one without code changes.

Handle every response

• Access tokens are cached and renewed about a minute before expiry. See authentication.
• Your code checks isSuccess, surfaces validation messages, and handles responses without an envelope. See errors and retries.
• Reads retry with exponential backoff and a maximum attempt count. Writes are only replayed after you've confirmed the first attempt didn't succeed.
• List operations page until hasNextPage is false.
• Requests time out after a reasonable limit, such as 30 seconds, instead of waiting forever.

Make it supportable

• Every failed request is logged with its X-Trace-Id, UTC time, method, path, and status code, but not credentials or unnecessary personal data.
• Someone is alerted when failures repeat, such as several consecutive 401 or 5xx responses.
• You can pause the integration and resume it from where it stopped without creating duplicates.

Test before launch

• Run a full sync against a non-production environment, if crmSeries has provided one, and review the records with the dealership.
• Test the failure paths on purpose: an expired token, a revoked credential, a record that fails validation, and a request that times out.
• For operations that match records by your identifier, send the same record twice and confirm the second request updates it instead of creating a duplicate.