App builder checkpoint

The single most valuable addition to an integration is:

It separates fresh from behind from failed. Without it those three states all render as an empty result and none of them errors, so a broken data source looks like a user with no data.

Where must the API key live?

Anything shipped to a browser or a phone is extractable. A backend proxy also gives you the per-user rate limiting the gateway cannot do, since it does not know your users.

Which data is safe to cache for a long time?

History below a confirmed block does not change retroactively, which makes it unusually cacheable. Only data near the head needs frequent revalidation.

Before depending on a third-party subgraph, the most important check is:

A published subgraph with no allocation returns nothing useful, and one that failed at some block keeps answering with data up to that block forever. Neither state announces itself.