Topic · 37 lessons in 12 series
API design
Designing APIs people enjoy using: REST, GraphQL and gRPC, status codes, pagination, versioning, idempotency, rate limiting and documentation.
System DesignWhole series →
- Reverse Proxy vs API GatewayReverse proxy, load balancer and API gateway get used interchangeably — NGINX is called all three. What each one is actually for, where authentication and rate limiting belong, the Backend-for-Frontend pattern, and when a gateway is overkill.8 min
- REST API Design Best PracticesAn API is a contract other teams depend on for years. How to design REST APIs that are predictable: nouns and HTTP methods, honest status codes, one error shape, filtering and pagination, free HTTP features, security basics and OpenAPI.12 min
- gRPC & Protocol Buffers for BeginnersForty internal services, dozens of calls per page, JSON everywhere and contracts in a stale wiki. How gRPC and Protocol Buffers give services fast, typed, streaming calls — and the schema-evolution and load-balancing rules you must follow.10 min
- GraphQL vs REST: When to Use WhichSix REST calls to draw one profile screen, and most of the data thrown away. How GraphQL lets clients ask for exactly what they need in one request, what that costs the server — N+1, caching, expensive queries — and when to pick REST, GraphQL or gRPC.8 min
- Idempotency, Pagination & API VersioningA retried payment that charges twice, a list endpoint that loads three million rows, a renamed field that crashes every old app. Idempotency keys, cursor pagination and careful versioning — the unglamorous details that separate a demo API from a production one.10 min
- Rate Limiting Algorithms ExplainedOne buggy script calling 5,000 times a second can hurt every customer. How rate limiting protects your system and keeps usage fair: the five classic algorithms — with a simulator you can drive — distributed limiting in Redis, and how to tell clients to slow down.12 min
- Design a Rate LimiterDesigning the rate limiter itself, as a real service: 100,000 requests a second, many rules per request, sub-millisecond checks. Requirements, estimates, a rule model, a Redis-backed gateway design, atomic Lua checks, hot keys, fail-open vs fail-closed, and multi-region.15 min
The Browser ContractWhole series →
Backend in DepthWhole series →
- API Folder Structure: Routes, Controllers, Services, RepositoriesLayers vs grouping by business feature, what goes in each layer, and why the request object should never reach your service layer.20 min
- REST API Design Best Practices: Resources, Versioning, Status CodesNouns, not verbs. One error format. Ways to version an API. Idempotency keys for POST, and partial updates.18 min
- Database Fundamentals for API Engineers: Indexes, Transactions, IsolationB-tree indexes, reading EXPLAIN ANALYZE, transactions and isolation levels, and the race conditions they stop, like selling too many items.20 min
- REST vs GraphQL (vs Hasura): How to ChooseFetching too much or too little, how caching is different, changing the schema over time, limits on query cost, and where an auto-generated API fits.18 min
- Testing an API: Unit, Integration and ContractWhere to spend your testing effort in a backend, testing against a real database, and contract tests between the frontend and the API.15 min
Scenario DebuggingWhole series →
Practical Design ProblemsWhole series →
- Design a Rate LimiterToken bucket, leaky bucket, fixed and sliding windows, where to apply limits, 429 with Retry-After, and the new RateLimit headers.22 min
- Design Pagination: Offset vs Cursor (Keyset)Why a large OFFSET is slow, how keyset paging works with a stable sort and a tiebreaker, opaque cursors and GraphQL connections.18 min
- Design an LRU Cache, Idempotent Payments and Other Classic Mini-ProblemsShort worked designs: an LRU cache, idempotency keys, a job queue with retries and backoff, and feature flags.20 min
Full-Stack QuestionsWhole series →
- Hasura & GraphQL Interview QuestionsHow Hasura works, permissions, remote schemas, actions, events, subscriptions and GraphQL core ideas.29 min
- Queues, Background Jobs and WebhooksWhy queues, BullMQ, retries and backoff, dead letters, idempotency, the outbox pattern, receiving and sending webhooks, RabbitMQ vs Kafka vs SQS.30 min
- GraphQL Beyond HasuraSchema design, nullability, DataLoader, cursor pagination, errors, mutations, limits, subscriptions, federation, and when not to use GraphQL.22 min
- tRPC, REST and OpenAPItRPC for your own TypeScript app, REST plus OpenAPI for outside callers: generated clients, contract tests, breaking changes, problem-details errors and idempotency keys.24 min
Design Patterns & LLDWhole series →
System Design Case Studies 2Whole series →
Testing From ZeroWhole series →
Security for DevelopersWhole series →
- Passwords and Login: Hashing, Sessions, MFA and Rate LimitsWhy you never store passwords, hashing with a salt (scrypt and Argon2), safe sessions and JWT mistakes, password reset flows, MFA, and stopping brute force.16 min
- APIs and Servers: SSRF, File Uploads, Rate Limits and MisconfigurationServer-side request forgery, unsafe file uploads, missing rate limits, verbose errors, CORS mistakes and the OWASP API Top 10, each with a small example and a fix.15 min
API DesignWhole series →
- What Makes a Good API: Resources, URLs and the ContractWhat an API contract is, REST in plain words, naming resources and URLs, and the rules that make an API predictable.12 min
- HTTP Methods, Status Codes and Idempotency in PracticeGET, POST, PUT, PATCH and DELETE used correctly, the status codes that matter, and why idempotency decides whether a retry is safe.14 min
- Request and Response Design: JSON Shapes, Errors and ValidationConsistent JSON, naming, dates and money, one error format (RFC 9457 problem details), validation with clear messages, and what never to return.14 min
- Pagination, Filtering and SortingOffset versus cursor pagination with real timings, stable ordering, filters, sorting, and how to return links and counts.14 min
- Versioning, Compatibility and Evolving an APIBreaking versus safe changes, URL, header and date versions, deprecation, and how to change an API without breaking clients.13 min
- Idempotency Keys, Retries, Webhooks and Rate LimitsSafe retries with idempotency keys, webhooks with signatures and retries, rate limit headers, and long-running jobs.15 min
- API Authentication and Authorization: API Keys, OAuth 2.0 and ScopesAPI keys, bearer tokens, OAuth 2.0 flows in plain words, scopes, and common mistakes. Ties back to the Security series.15 min
- Documenting APIs: OpenAPI, Contracts and TestingWrite an OpenAPI file, generate docs, validate requests and responses against it, contract tests and mock servers.13 min
- GraphQL and gRPC: When Not to Use RESTWhat problems GraphQL and gRPC solve, the real costs (N+1, caching, tooling), a small working example of each, and a decision table.15 min
- API Design Interview Questions and Review ChecklistA checklist to review any API, and the questions interviewers ask with model answers.15 min