API Gateway Platform · View 04 of 21 · People and journeys
The finding
- The sentiment line bottoms out at the first call, not at sign-up. Self-service registration is table stakes; the failure that loses the developer is an authentication error that does not say what was wrong.
- The recovery at phase four is entirely a property of the error payload: a 429 that names which of four scopes was hit, with the limit, the remaining allowance and a computed Retry-After.
- This is why typed auth errors and always-on limit headers are requirements in ask.md rather than polish.
Assumptions
- Ten minutes from registration to first 200 is the target (assumption; no measured baseline exists yet).
- Sandbox credentials traverse the same policy path as production, so the first production call is not the first time the policy path is exercised.
Risks
- Showing a secret once is correct and is also the most common support ticket. Rotation with an overlap window is the mitigation, and it must be on the same screen.
