Production readiness

Use this checklist before moving a DeGallery integration from development to production.

Credentials and authorization

• Store server API keys in your secret manager, not in source control.
• Use separate credentials for development, staging, and production.
• Use publishable keys or bounded read tokens in browser code.
• Check organization and gallery ownership on the server before issuing private access.
• Do not treat a public image URL as permission to read private metadata.

Upload reliability

• Create uploads through an intent rather than accepting arbitrary storage paths.
• Send the exact content type and bytes represented by the intent.
• Treat storage PUT success and asset completion as separate states.
• Retry completion for the same intent instead of creating a second intent.
• Display processing state until the asset is available for delivery.

Delivery performance

• Fetch gallery metadata once per page or cache window.
• Let the media edge serve repeat image requests and transformations.
• Use stable asset IDs for React keys and cache identifiers.
• Request only the image dimensions and formats your layout needs.
• Keep analytics ingestion independent from the image response path.

Observability

• Record upload intent IDs in server logs without logging credentials.
• Track rejected uploads separately from completed assets.
• Monitor edge cache hit ratio, transformation errors, and origin fallback.
• Add request IDs to application logs when calling the API.