API Versioning Without Tears: Sunset Headers, Major Versions, and a Go Implementation
Sooner or later every API team hits the wall: a client depends on behavior you need to change. The field
Tag: api-design
OAuth for CLIs and SPAs in 2026: PKCE, Loopback Redirects, and the RFC 9700 Checklist
If you shipped a CLI tool or a single-page app in the last few years, you have probably implemented “OAuth”
Beyond OFFSET: Keyset Pagination in PostgreSQL That Actually Scales
Offset pagination is the first thing everyone learns and the first thing that falls over in production. The product manager
Continue readingBeyond OFFSET: Keyset Pagination in PostgreSQL That Actually Scales
API Versioning in Go: URL Strategies, Breaking Changes, and Deprecation That Doesn’t Break People
One Tuesday your API’s most popular endpoint works fine. Two Tuesdays later, a mobile app that has been calling it
Distributed Rate Limiting in Go: GCRA, Redis, and the Pitfalls Nobody Warns You About
Every production rate limiter has two layers. The first layer is the algorithm: token bucket, leaky bucket, fixed window, sliding
Idempotency Keys Done Right: Building Retry-Safe APIs That Never Double-Charge
You hit “Place Order,” the spinner hangs for ten seconds, and you tap the button again. Now the fear sets
Continue readingIdempotency Keys Done Right: Building Retry-Safe APIs That Never Double-Charge
Load Balancing Beyond Round Robin: Least Outstanding Requests and Consistent Hashing
Here is a failure mode that shows up in every system with more than two backends: round robin distributes requests
Continue readingLoad Balancing Beyond Round Robin: Least Outstanding Requests and Consistent Hashing
API Pagination Strategies: Offset, Cursor, and Relay Connections Done Right
Sooner or later, every API designer hits the pagination wall. The endpoint works fine in staging, then production traffic arrives
Continue readingAPI Pagination Strategies: Offset, Cursor, and Relay Connections Done Right
Deprecating API Endpoints Without Breaking Consumers: Deprecation and Sunset Headers
Every API with more than a handful of consumers eventually faces the same problem: an endpoint or field you designed
Continue readingDeprecating API Endpoints Without Breaking Consumers: Deprecation and Sunset Headers
JWT Security Pitfalls: Algorithm Confusion, Header Injection, and the Claims Everyone Forgets to Check
JWTs are everywhere because they solve an ugly problem: how does a stateless service know who’s calling without a database