Skip to main content
Rust integrates through the Execution Fabric REST API. Keep the API key in your server process and expose an application-specific authenticated endpoint to browsers or mobile clients.

Prerequisites

Before you begin, prepare:
  • a trusted server runtime and application authentication boundary;
  • a disposable personal workspace Praxa key with only the tutorial’s required scopes;
  • synthetic input plus a persisted application request ID for replay tests;
  • a fake upstream for unit tests and a non-production environment for canaries;
  • an acceptance assertion that proves the reusable reqwest client preserves authority, deadlines, replay, and redacted failures.

1. Add dependencies

Cargo.toml

2. Create a reusable client

src/praxa.rs
Reuse the reqwest::Client so requests share connection pooling. Do not create a new client inside every handler.

3. Call it from your server handler

Your Axum, Actix Web, or Rocket handler should:
  1. authenticate the application caller;
  2. derive user_id from that principal;
  3. validate logical_request_id and input;
  4. call submit_task;
  5. return a customer-safe projection with Cache-Control: no-store.
Do not accept the Praxa key, tenant, owner, or scope from the JSON body.

4. Test with a mock server

Point a test-only client at an injected origin, then assert:
  • authorization and idempotency headers are present upstream;
  • the same user and request ID produce the same key;
  • different users produce different keys;
  • invalid input makes zero upstream calls;
  • 401, 403, 409, and 429 stay distinguishable;
  • error bodies are not reflected to untrusted callers.
Run Rust’s standard gates:

5. Verify live behavior

Use a disposable key with execute:write and runs:read. Submit one task, read /v1/runs/{id} until terminal, then revoke the key. Repeat an exact request with the same logical ID and require the same logical run.

Troubleshooting

Best practices

  • Reuse the HTTP client.
  • Bound connect, request, and overall operation time.
  • Make authority types distinct from request-body types.
  • Redact response bodies before logging.
  • Preserve the body digest and key for reconciliation.
  • Use rustls or your reviewed TLS backend; never disable certificate checks.

reqwest client

Review current timeout, TLS, header, and connection-pooling options in the reqwest reference.

Optimize for production

  • Reuse one configured HTTP or SDK client per process and bound concurrent upstream work.
  • Prefer durable admission plus asynchronous readback over holding application requests open.
  • Cache only non-sensitive, tenant-scoped reads within their documented freshness window.
  • Measure p50/p95 latency, admission-to-terminal time, retries, conflicts, and connection reuse before tuning.
Optimize only after the correctness and isolation matrix passes. Lower latency or cost is not an improvement if verified outcomes, authority checks, or recovery rates regress.

Cleanup and next steps

  1. Revoke the disposable Praxa key and require a later request to fail.
  2. Remove synthetic application records and any temporary environment files.
  3. Cancel or archive unresolved test runs according to the application policy.
  4. Retain only redacted request, run, and verification identifiers needed for the test record.
After cleanup, run the shared integration test matrix and record any environment-specific check that remains pending.

Frequently asked questions

What proves this tutorial works?

The minimum observable result is that the reusable reqwest client preserves authority, deadlines, replay, and redacted failures. A compile, package import, mocked response, or initial admission alone does not prove the complete workflow.

Can a browser, mobile app, or model prompt hold the credential?

No. Browser and mobile bundles are inspectable. Keep the Praxa credential in the trusted application backend.

How should an ambiguous mutation be retried?

Persist the exact logical input and idempotency key before the first attempt. Reconcile through authoritative readback or replay the exact request with that same key before creating new work.

What should we monitor after release?

Monitor application auth failures, upstream status/code, latency, retries, replay conflicts, and terminal run outcomes. Alert on authorization bypass, cross-tenant disclosure, repeated conflicts, or cleanup failure.
Last modified on August 14, 2026