# Production integration

This reference accompanies the service implementation; deployment and integration certification are separate steps. Before launching real traffic, certify each provider route, parameter schema, price calculation, streaming usage, payment signature, and failure-recovery path against a separate test environment.

- Use server-side keys, TLS, explicit timeouts, bounded polling, and request IDs.
- Persist idempotency records before submission; a paid upstream POST is never blindly retried after an ambiguous transport failure.
- Keep wallet ledger, holds, key budgets, and payment settlement transactional in MySQL. Use DynamoDB for request event/query projections and 30-day request-log retention, not as a competing wallet authority.
- Submit directly after persisting the hold and claim. Return an asynchronous task only after receiving its upstream ID. Task GET polls and settles; a periodic reconciler checks unattended tasks and retries failed log writes.
- Default logs contain metadata only and expire after 30 days. Do not persist prompts, chat content, input files, generated files, Authorization headers, or payment secrets in these logs.
- Ledger and payment records have a separate retention policy; deleting request metadata must not delete financial history. Production retention requirements must be finalized before launch.
- Alarm on reconciliation backlog, stuck holds, duplicate settlement attempts, task latency, log retry backlog, provider errors, and payment mismatch.

Configure credentials, DNS/TLS, workload permissions and integration acceptance before launch.

[Tasks](/docs?page=tasks&lang=en) · [Billing](/docs?page=billing&lang=en)

MySQL owns task coordination, financial transactions and pending log retry records. Write metadata directly to DynamoDB with account/key/time projections, date buckets and LOG_SHARDS; filter expired records during queries. A lightweight reconciler polls unattended tasks and retries log writes. Web, gateway and reconciler are separate deployments. Successful responses return the original generated-media URL unchanged. The original host controls availability, expiry and browser cross-origin behavior. Save results before expiry; querying a completed task returns the saved URL and does not renew it. Request metadata and result URLs may be retained for recovery; generated-media bytes are never retained.