Tag

API Design

3 posts

August 2026

Retry Without Paying Twice: Idempotency Keys and the Draft That Expired in April Every payment API ships a header called Idempotency-Key, and no RFC defines it. The IETF draft that tried expired on 18 April 2026, is absent from the IANA field-name … Engineering 30 min read

July 2026

Rate Limits Are a Contract: Algorithms, Keys, State, and the Fail-Open Question Nobody Wants to Own A rate limit is not a throttle knob — it is a published promise with two failure modes, and most teams have never decided which one they signed up for. This post works … Engineering 21 min read

June 2026

The API Key Is the Tenant: Identity Models That Survive Multi-Tenancy Most cross-tenant data leaks are not exotic exploits; they are a missing WHERE clause, a trusted X-Tenant-ID header, or a query that resolved the tenant from one input … Engineering 19 min read

All posts