OpenAPI and SDKs as your integration source of truth

Apilyn publishes a versioned OpenAPI document at api.apilyn.com/v1/openapi.json and ships generated Python and TypeScript SDKs from that schema. Pin SDK versions in CI and you pin the error codes and field names your handlers expect.

Verify webhooks like you verify JWTs

Every outbound webhook includes a signature header. Your receiver should constant-time compare an HMAC of the raw body with a secret rotated through the dashboard. The sync tool webhook.hmac_verify exists so you can test vectors without standing up a full receiver.

# See sdk/samples/python/verify_webhook.py
signature = request.headers["Apilyn-Signature"]
assert verify(body, secret, signature)

Staging keys, production keys, separate orgs

Use organization boundaries the way you use AWS accounts: staging org for CI smoke tests, production org for customer traffic. API keys are scoped; rotate them from the dashboard and update your secret store—never embed keys in frontends.

When you need a human-friendly surface for experiments, Utiline on utiline.com is the consumer-facing client. Apilyn.com stays the B2B narrative; app.apilyn.com remains the control plane for keys, usage, and billing.