Tag
30 articles tagged #API.
P.01A practical RBAC pattern for Node.js and Postgres: roles, permissions, a middleware that checks both, and the traps that turn clean RBAC into unmaintainable spaghetti.
P.02PKCE stops a stolen OAuth code from being redeemed. It doesn't stop the wrong app from getting your redirect first. Here's the fix most mobile apps skip.
P.03Offset pagination breaks under concurrent writes and gets slower on every page. Cursor pagination fixes both, at the cost of features you might actually need.
P.04What OpenAI, Google, and xAI actually charge per million tokens right now, tier by tier, so you can price a real workload before picking a provider.
P.05A webhook receiver has to trust a request it can't control the timing, order, or count of. Verifying signatures, handling retries, surviving delivery chaos.
P.06OpenAI's full-duplex voice model powers ChatGPT Voice but isn't in the API yet. What GPT-Live-1 changed, and what to build with right now instead.
P.07OAuth 2.1 is still an IETF draft, but most providers enforce it already. What changed from 2.0, plus a checklist for auditing your own implementation.
P.08No Access-Control-Allow-Origin is the most Googled web error for a reason. What CORS is, why the browser enforces it, and how to configure it properly.
P.09DeepSeek retired deepseek-chat and deepseek-reasoner on July 24, 2026 and added peak-hour pricing. The real fix if your integration broke, not just a rename.
P.10Agents that shop or call paid APIs need a way to pay without a card in the prompt. What Google's AP2 and Coinbase's x402 each do, in plain terms.
P.11Webhooks push the moment something happens; polling asks repeatedly. How to decide, with code for both, and the hybrid most production systems land on.
P.12A single GraphQL schema works until several teams own different parts of the data. What federation solves, how Apollo composes subgraphs, and the cost.
P.13Idempotency keys let a client retry a request that may have already succeeded, without double-charging a card. The pattern, in Postgres and in Redis.
P.14FastAPI's June 2026 refactor preserves routes instead of cloning them, makes dynamic registration work, and adds app.frontend() for serving SPAs.
P.15While the ecosystem chased Bun, Deno, and edge runtimes, Fastify stayed the production choice for high-throughput Node APIs. Why it still holds up.
P.16Pydantic v2's Rust core made validation 5-50x faster, but the model redesign is what changes how you structure validation logic for real APIs.
P.17The OWASP API Security Top 10 catalogs the most exploited API vulnerabilities, from broken authorization to unsafe consumption, each fixable with targeted code.
P.18ElysiaJS gives Bun APIs fast routing, TypeBox validation, and type inference that reaches the client with no codegen step. How it works and when to pick it.
P.19Bruno stores API collections as plain .bru text files in your git repo, no account or cloud sync needed. Here's how it compares to Postman and why teams switch.
P.20Go has real strengths and real limitations for backend APIs. Here's what teams actually gain and give up choosing it over Node.js or Python in 2026.
P.21Building SaaS billing on Stripe means handling subscription plans, the Meter API for usage-based pricing, webhook reliability, and the Customer Portal.
P.22Stripe's API now covers far more than checkout. This breaks down which Stripe products agencies actually need, which are overkill, and where teams get burned.
P.23The implicit flow is dead and tutorials still teach it. How authorization code flow with PKCE works, where tokens belong, and where SPA auth goes wrong.
P.24gRPC has been available for years but many teams default to REST without thinking through the tradeoffs. Here's how gRPC works, where it fits, and where it doesn't.
P.25k6 is a load testing tool with JavaScript scripting and CI integration. Writing meaningful tests, reading the results, and catching regressions early.
P.26URL versioning, header versioning, and content negotiation compared with real code. Here's how to pick one and retire old versions without stranding clients.
P.27Every public API needs rate limiting, but the algorithm you choose shapes the user experience and the failure modes. Here's how each approach works and when to use it.
P.28Use reasoning models for multi-step code, math and planning, not lookups or chat. How effort and thinking levels work in Claude, OpenAI, Gemini and DeepSeek.
P.29EditorPickMost DRF vs FastAPI comparisons are written by people who only use one. We ship both in production. Here is what actually matters and when to choose each.
P.30The GraphQL vs REST debate is over: they solve different problems. Here's how to choose between REST, GraphQL, tRPC, and gRPC for your use case.