clay-known-pitfalls

// User waits for Clay API call
app.post('/checkout', async (req, res) => {
  const payment = await clayClient.processPayment(req.body);  // 2-5s latency
  const notification = await clayClient.sendEmail(payment);   // Another 1-2s
  res.json({ success: true });  // User waited 3-7s
});

// Return immediately, process async
app.post('/checkout', async (req, res) => {
  const jobId = await queue.enqueue('process-checkout', req.body);
  res.json({ jobId, status: 'processing' });  // 50ms response
});
 
// Background job
async

// Blast requests, crash on 429
for (const item of items) {
  await clayClient.process(item);  // Will hit rate limit
}

import pLimit from 'p-limit';
 
const limit = pLimit(5);  // Max 5 concurrent
const rateLimiter = new RateLimiter({ tokensPerSecond: 10 });
 
for (const item of items) {
  await rateLimiter.acquire();
  await limit(() =>

// In frontend code (visible to users!)
const client = new ClayClient({
  apiKey: 'sk_live_ACTUAL_KEY_HERE',  // Anyone can see this
});
 
// In git history
git commit -m "add API key"  // Exposed forever

// Backend only, environment variable
const client = new ClayClient({
  apiKey: process.env.CLAY_API_KEY,
});
 
// Use .gitignore
.env
.env.local
.env.*.local

// Network error on response = duplicate charge!
try {
  await clayClient.charge(order);
} catch (error) {
  if (error.code === 'NETWORK_ERROR') {
    await clayClient.charge(order);  // Charged twice!
  }
}

const idempotencyKey = `order-${order.id}-${Date.now()}`;
 
await clayClient.charge(order, {
  idempotencyKey,  // Safe to retry
});

// Trust any incoming request
app.post('/webhook', (req, res) => {
  processWebhook(req.body);  // Attacker can send fake events
  res.sendStatus(200);
});

app.post('/webhook',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    const signature = req.headers['x-clay-signature'];
    if (!verifyClaySignature(req.body, signature)) {
      return res.sendStatus(401);

// Crashes on any error
const result = await clayClient.get(id);
console.log(result.data.nested.value);  // TypeError if missing

try {
  const result = await clayClient.get(id);
  console.log(result?.data?.nested?.value ?? 'default');
} catch (error) {
  if (error instanceof ClayNotFoundError) {
    return null;
  }
  if (error instanceof ClayRateLimitError) {

const client = new ClayClient({
  timeout: 5000,  // Too short for some operations
  baseUrl: 'https://api.clay.com',  // Can't change for staging
});

const client = new ClayClient({
  timeout: parseInt(process.env.CLAY_TIMEOUT || '30000'),
  baseUrl: process.env.CLAY_BASE_URL || 'https://api.clay.com',
});

// When Clay is down, every request hangs
for (const user of users) {
  await clayClient.sync(user);  // All timeout sequentially
}

import CircuitBreaker from 'opossum';
 
const breaker = new CircuitBreaker(clayClient.sync, {
  timeout: 10000,
  errorThresholdPercentage: 50,
  resetTimeout: 30000,
});
 
// Fails fast when circuit is open
for (const user of users) {
  await breaker.fire(user).

console.log('Request:', JSON.stringify(request));  // Logs API key, PII
console.log('User:', user);  // Logs email, phone

const redacted = {
  ...request,
  apiKey: '[REDACTED]',
  user: { id: user.id },  // Only non-sensitive fields
};
console.log('Request:', JSON.stringify(redacted));

// Entire feature broken if Clay is down
const recommendations = await clayClient.getRecommendations(userId);
return renderPage({ recommendations });  // Page crashes

let recommendations;
try {
  recommendations = await clayClient.getRecommendations(userId);
} catch (error) {
  recommendations = await getFallbackRecommendations(userId);
  reportDegradedService('clay', error);
}
return renderPage({ recommendations, degraded: !recommendations });

# Check for common pitfalls
grep -r "sk_live_" --include="*.ts" src/        # Key leakage
grep -r "console.log" --include="*.ts" src/     # Potential PII logging