Choosing an Integration Pattern
Most agent workflows start with a direct REST call and graduate to a thin SDK wrapper once the integration stabilizes. Keep the API client isolated behind a single module so keys, retries, and timeouts live in one place.
Wrap every call in a typed function that returns a predictable result object. Agents reason about ok and error shapes far better than raw exception traces.
Pro Tip: Fail Securely
Deny by default. If a token is missing or expired, return a typed error instead of falling back to unauthenticated access. Least-privilege scopes prevent a leaked key from becoming a full account compromise.
Auth Isolation
A dedicated service principal per workflow means one revoked key can't take down every agent.
Rate-Limit Awareness
Read `Retry-After` headers and back off automatically to keep agents under provider quotas.
A Minimal Typed Client
const API = {
baseUrl: process.env.PROVIDER_BASE_URL,
key: process.env.PROVIDER_API_KEY,
};
export async function callAgentEndpoint(path, payload) {
const res = await fetch(API.baseUrl + path, {
method: 'POST',
headers: {
Authorization: `Bearer ${API.key}`,
'Content-Type': 'application/json',
},
body: JSON.stringify(payload),
});
if (!res.ok) return { ok: false, error: await res.text() };
return { ok: true, data: await res.json() };
}