API rate limit compliance enforced

Third-party data APIs (Apollo, Clearbit, Hunter, People Data Labs, ZoomInfo) enforce rate limits contractually. Ignoring 429 responses and retrying without backoff burns your monthly API quota in minutes, crashes enrichment pipelines, and may violate ToS. OWASP A05 (Security Misconfiguration) includes failure to honor upstream service constraints. Key cycling — rotating through multiple API keys to exceed per-account limits — is an explicit ToS violation that can result in account termination and, for GDPR-regulated data, loss of the legal basis for processing contacts sourced through that API.

Wrap all third-party data API calls in a retry wrapper that reads Retry-After headers and backs off exponentially. Remove any key-rotation arrays — one API key per provider, no exceptions.

// src/lib/api/retry.ts
export async function callDataApi<T>(
  fn: () => Promise<T>,
  retries = 3
): Promise<T> {
  for (let attempt = 0; attempt < retries; attempt++) {
    try {
      return await fn()
    } catch (err: any) {
      if (err.status === 429) {
        const wait = parseInt(err.headers?.['retry-after'] ?? '60', 10)
        await sleep(wait * 1000)
        continue
      }
      throw err
    }
  }
  throw new Error('Max retries exceeded')
}

Search the codebase for arrays of API keys assigned to the same provider (APOLLO_API_KEYS, CLEARBIT_KEYS, etc.) and remove them entirely.