Production checklist
Keep API keys server-side; never expose secrets in the browser.
Set timeouts and decide whether form submit blocks on verification or continues with a deferred check.
Test every response category—including unknown—before go-live.