Api Design

Prerequisite: Part 7 of the System Design Masterclass. Read Part 6: Distributed Locks first. What You’ll Learn Payload Reuse Vulnerability: How Stripe prevents malicious request payload tampering on existing keys using SHA-256 request body hashes in Redis. SetNX Lock Lifetime Math: Why setting a lock TTL without a auto-extension renewal thread leads to double-charge execution gaps. Response Record Memory Leak: The memory consumption strategy of caching full HTTP headers and response body data under high-throughput request rates. What Is an Idempotency Key? Key Concept: An Idempotency Key is a unique token — typically UUID v4 — generated by the client and attached as an Idempotency-Key HTTP header. The server uses this key to detect duplicate requests: if the key has been seen before, return the cached response from the first execution without re-executing the handler. ...

Prerequisite: Read the previous article: Chapter 6: API Gateway vs Service Mesh in Microservices Architecture. In E-commerce or Fintech, the ultimate nightmare is not a system crash, but charging a customer twice for a single order. This is usually caused by network lag, an impatient user double-clicking “Pay”, or automated app retry logic. The mandatory solution for any transactional API (Payment/Order) is Idempotency. 1. What is Idempotency? An operation is idempotent if executing it once or N times yields the exact same system state and outcome. While GET and PUT are natively idempotent, POST requires explicit engineering. ...

Production AI APIs: OAuth 2.1, Gateway Rate Limiting & Prompt Versioning Running AI APIs in production for the past 18 months has produced three lessons that I did not find in any “getting started with LLMs” tutorial. They emerged from incidents, postmortems, and that specific kind of 2 AM Slack message where a word you never wanted to see — “silent,” as in “silent failure” — appears in a production context. ...