A few guidelines that keep your integration fast and your keys safe.
- Never expose a write-scoped API key in client code — use a read-only, domain-restricted key for Slash for Web.
- Lazy-load the launcher behind user intent (e.g. a keyboard shortcut or button) rather than on initial page load.
- Prefer theme="system" so the launcher stays in sync with the rest of your app without extra state.
- Debounce onSelect handlers that trigger navigation or network requests to avoid duplicate calls.
- Pin your @slash.tools package versions and review the changelog before upgrading in production.