Exa CI Contract Verification

Overview

Add deterministic Exa contract checks to CI while keeping live credentials, spend, and volatile web results out of ordinary pull requests. Treat credentials, queries, retrieved content, generated output, spend, and destructive state as separately governed boundaries.

Prerequisites

• The target repository, environment, Exa team, product surface, and accountable owner.
• The workload's data classification, latency and freshness promise, cost ceiling, and retention policy.
• Current first-party documentation plus credentials only for a narrowly approved live check.

Current Contract

Offline CI can verify owned request and response schemas, error tags, webhook signatures, and redaction. A live lane should be protected, synthetic, manually or schedule authorized, tightly budgeted, and non-blocking until its reliability is understood.

Authentication

For normal REST work, inject EXA_API_KEY from an approved server-side secret manager and send it only as Authorization: Bearer to the configured first-party Exa API host. Team Management service keys, hosted MCP OAuth or enterprise managed authorization, and payment-protocol calls are separate trust models. Never print, commit, place in a URL, or expose a credential to an untrusted client.