Skip to main content
  • Keep API keys and webhook secrets on the server only. Rotate them if exposed.
  • Fund the Business wallet before placing orders via API.
  • Custom rates are set by RUN admin. Use GET /business/rate-cards only to read vehicle options, then quote/place with vehicle_type (and option_id for bus/van or truck). Do not hardcode prices.
  • Handle webhook retries with idempotency on evt_… ids.
  • Prefer sending lat/lng when you already have Places/map coordinates to skip geocode latency.
  • Log path + statusCode from error responses for support — never log full API keys or Authorization headers.
  • Use a run_test_… key against staging while integrating, then switch to a run_live_… key only against production.
  • Return 2xx quickly from webhook handlers and do heavy work asynchronously after verifying the signature.