api
Webhook deliveries are HTTP requests, and HTTP requests carry headers, and most webhook providers underuse the header surface. The right set of headers makes signature verification cleaner, makes replay handling possible, and lets customers debug delivery problems without instrumenting their ow
api
Customer integrations often assume webhook events arrive in the order they happened. The honest engineering answer is that no widely used webhook system reliably preserves order across retries, parallelism, and recovery. Promising ordering you cannot deliver produces support escalations; refusi
api
Every API that supports webhooks has to decide how many endpoints a single customer can register. The default is usually too low or unlimited—both are wrong. The right number balances support cost, abuse vector, and customer integration patterns, and most providers converge on similar limits fo
api
Authorization scopes let customers limit what an API key can do. The design space is wider than it looks: too few scopes leave customers exposed to credential theft, too many scopes overwhelm customers and produce inconsistent application. Most APIs that get scopes right start small and iterate
api
File uploads look simple until production traffic arrives. The naive single-POST design fails on large files, on unreliable mobile networks, on duplicate uploads, on partial failures. The patterns that scale handle resumability, deduplication, validation, and bounded storage cost.
api
Most webhook providers send every event of a subscribed type to every subscriber. Customer-side filtering wastes bandwidth and forces customers to write their own filter logic. Send-time filtering trades server complexity for substantial customer-side savings, and the trade is usually worth it.
api
API responses with nested resources can either embed the full child or return a reference the client follows separately. The decision shapes latency, payload size, and customer integration complexity. The right answer is usually neither default.
api
Webhook signature verification is the boundary that determines whether your integration is a security feature or a security hole. Most webhook receivers we see have subtle verification bugs that pass casual review but fail under adversarial conditions.
api
When a list endpoint returns 30 fields per object and the customer wants 3, response sizes compound across pages and machines. Field selection is the underused API pattern that makes large responses survivable.
api
How to extend the single-item update semantic to operate on hundreds of resources at once without producing the half-applied failure mode that bulk endpoints commonly inherit from naive scaling of single-item APIs.
api
The most-used endpoint shape in any API and the one that most often grows unmaintainable through accumulated filter parameters and ordering options. The patterns that hold up across years of customer integration evolution.
api
Two HTTP methods that look similar on the wire and mean different things in practice. The difference matters once customers start building integrations that need partial updates.