Integrate a third-party API with proper error handling and retries

Build a client module for integrating with the [API name] API in my [language/framework, e.g. TypeScript/Node.js, Next.js server actions] project.

API details:
- Base URL / docs link: [paste or describe]
- Auth method: [API key header / OAuth2 / bearer token — describe]
- Endpoints I need to call: [list them, e.g. "POST /invoices, GET /invoices/:id, GET /invoices?status=paid"]
- Rate limits I know about: [describe, or say "unknown — handle defensively"]

Build:
1. A typed client with one function per endpoint, using TypeScript interfaces (or your language's type system) for both request and response shapes
2. Centralized auth handling (reading the key/token from environment variables, never hardcoded)
3. Retry logic with exponential backoff for transient failures (5xx, timeouts, network errors) — but NOT for 4xx client errors, which should fail immediately with a clear error
4. Rate-limit handling: respect any Retry-After header if the API sends one, otherwise use a sane backoff
5. Consistent error handling — throw or return a typed error object that distinguishes "network/API is down", "invalid input", and "auth failed" as different cases
6. A small in-memory or documented example of how to call this client from the rest of the app
7. Unit tests that mock the HTTP layer and cover: success, 4xx, 5xx-then-success-on-retry, and rate-limit response

Also tell me:
- What sensitive data (keys, tokens) needs to go in environment variables and never be committed
- Anything about this API's behavior that seems fragile or worth monitoring in production