SparkGlim Developer
Keep each boundary intact.
Build with the actual credential, scope, domain and request protections of each API. Do not infer a universal rate limit or certification.
Safe implementation
Keep private keys and signing on the backend. Public browser code receives only the minimum safe data needed for the displayed experience.
Domains and request origin
For Organization private requests, sign the documented canonical request with a fresh nonce and valid timestamp. Keep a stable business idempotency key separate from the per-attempt nonce.
Validation and permissions
Treat authorization and validation failures as actionable errors, not a reason to broaden scopes automatically. Campaign visibility and member permissions remain server-enforced.
Retries and idempotency
Apply bounded retry behavior to transient failures and respect any actual throttling response. This page does not claim one numeric quota, global service-level guarantee or external security certification.