Building on a hosted model means depending on infrastructure you do not operate.
Providers have incidents, impose rate limits, and occasionally get much slower for an hour.
A system with no plan for that simply passes the failure on to its users.
The first layer of defence is the timeout, and it is the one most often missing.
A request with no timeout can hang for minutes, holding a connection and a worker.
Set one deliberately, based on measured latency rather than on hope.
The second layer is retry with exponential backoff and jitter, for transient errors only.
Retrying a rate limit immediately makes the rate limit worse, which is why backoff is not optional.
The third layer is a circuit breaker: after repeated failures, stop trying for a while.
That protects your own system from spending everything on requests that will fail.
The fourth is the fallback path, and there are several kinds worth having.
A second provider behind the same interface, a smaller model, or a previously cached answer.
Degrading gracefully means choosing what the feature looks like when the good path is unavailable.
A cached summary with a note that it is not current beats an error page in almost every product.
The most important part is testing: fallbacks that are never exercised are usually broken when needed.