Keep secrets out of source
Read yourx-api-key and x-project-id from the environment (or a secrets manager) and inject them at deploy time. Never commit them, never ship them in a browser bundle or mobile app - a key embedded in client-side code is a public key.
Handle status codes explicitly
Branch on the status code. Authentication and authorization errors are permanent - retrying them just burns time and quota. Rate limits and server errors are transient - those are the ones to retry.Treat
408 (request timeout) and 409 (conflict) the same as 5xx for retry purposes. Network errors and client-side timeouts are retriable too.Set timeouts and retries
Three rules cover almost every case:- Set a per-request timeout so a stalled connection can’t hang your worker.
- Retry only the transient codes (
408,429,5xx) and network failures - never401,403, or400. - Back off exponentially with jitter, cap the delay, cap the attempts, and honor the
Retry-Afterheader on429.
Using the OpenAI SDK (recommended)
If you call ZeroGPU through the drop-in OpenAI client, timeouts and retries are built in - settimeout and max_retries once on the client. The SDK retries 408, 409, 429, and 5xx with exponential backoff and respects Retry-After automatically.
client.responses.create(..., timeout=60.0).
Rolling your own
When you call the HTTP API directly, implement the loop yourself: a per-request timeout, a retriable-status check, and exponential backoff with jitter that honorsRetry-After.

