Skip to main content
Before taking a Memic-backed app to production, run through this checklist. None of it is hard, but missing any one item has bitten customers.

​
Environments

  • Using a production environment — not running prod traffic through your staging environment
  • Separate API keys for each environment — never share keys across environments
  • Keys stored as secrets — not committed to source control, not in client-side code

​
Authentication

  • X-API-Key header is set on every request — otherwise the API returns 401
  • Keys are rotated annually (or sooner if anyone with access leaves)
  • API keys are never sent to the browser — the Memic API should be called from your backend, not client-side JavaScript

​
Error handling

  • Retry 5xx and 429 responses with exponential backoff
  • Respect the Retry-After header on 429 responses
  • Do not retry 4xx responses other than 429 — they won’t succeed
  • Log the request_id from error responses so you can correlate with Memic support tickets
  • Surface user-friendly error messages, not raw JSON

​
File ingestion

  • Poll /files/{id}/status until ready before searching — don’t assume files are immediately searchable
  • Handle failed processing status — present the reason to the user and let them retry
  • Enforce file size limits in your UI before uploading to Memic — 100MB is the Memic limit
  • Validate file types client-side too — avoid a round-trip for unsupported formats

​
Search and chat

  • Cache identical queries where appropriate — search and chat are rate-limited
  • Use top_k appropriate to your UI — 5-10 for RAG prompts, 20+ for search UIs
  • Render citations on chat responses so users can verify answers
  • Set sensible timeouts on your HTTP client — 30s for search, 60s for chat

​
Multi-tenancy

  • One environment per tenant if you’re building multi-tenant
  • Tenant-to-key mapping is stored server-side in your database
  • Your auth layer selects the right key based on the authenticated user’s tenant
  • End-to-end isolation test — verify that a user in Tenant A cannot see results from Tenant B’s environment

​
Monitoring

  • Log request latency from your side of the API call
  • Alert on error rate spikes — 429s, 5xxs
  • Track file processing failures as a business metric, not just an error log

​
Going live

  • Smoke test production end-to-end — upload a file, wait for ready, search, delete
  • Verify with GET /me that your production code is hitting the production environment
  • Document your rollback procedure — if a new prompt or code deploy causes issues, how do you revert?

Error handling

Full error codes and retry guidance.