The systems behind modern software.
Practical notes on APIs, infrastructure, AI, integrations, developer tooling, and everything else we learn while building reliable products.
Handling 429 Too Many Requests as a client: backoff, jitter, retry budgets
The client-side half of the 429 problem, measured: honoring Retry-After, exponential backoff with jitter, retry budgets, and the cases where retrying is simply the wrong move.
Sorower
Basic authentication in Spring Boot — and when API keys fit better
The SecurityFilterChain setup that actually compiles on Spring Security 7, tested with curl, plus the measured per-request cost of HTTP Basic and the honest case for API keys on machine-to-machine traffic.
Sorower
API pricing strategies: flat, tiered, prepaid credits, success-based
Four ways to charge for an API, priced against rate cards read this week, each with the counter it forces you to build. Plus the break-even arithmetic that decides whether success-based pricing can work at all.
Sorower
Failed requests due to blocks: why your API calls get rejected
A block isn't an error your API produced, it's another layer answering on its behalf. How to tell a WAF rule from a rate limit from a disabled key, using only what comes back in the response.
Sorower
What is API key rotation, and how do you automate it?
Rotation, regeneration and revocation are three different operations, and only one of them keeps your traffic alive. What rotation actually means, how to pick a schedule you can defend, and what has to be true about a provider's API before any of it can be automated.
Sorower
Fixing "Full authentication is required to access this resource" in Spring Boot
The message never means your API key was rejected. It means nothing read it. Seven causes reproduced on one Spring Boot app, each with the curl that triggers it.
Sorower
Fastify hooks: the lifecycle order that decides if your auth runs
A measured trace of every Fastify hook, which one your API key check belongs in, and what actually runs when a request never reaches your handler.
Sorower
What are API credits? How credit-based APIs meter usage
An API credit is a unit of consumption the provider defines, not a rebranded request. Here is what limit, remaining, refill and overage actually mean, why one endpoint costs 1 credit and another 250, and what a failed request does to your balance.
Sorower
Fastify rate limiting: what @fastify/rate-limit doesn't do for you
The plugin works in five lines, then quietly skips your earlier routes, your 404s, your other instances, and your second limiter. Five gaps, measured on Fastify 5.11.3.
Sorower
Next.js "middleware is deprecated, please use proxy": the migration guide
Next.js 16 renamed middleware.ts to proxy.ts. Here is the exact warning, the one command that migrates most projects, the case where that command silently does nothing, and where your API key check belongs afterwards.
Sorower
Revoked and still working: the API key revocation window
Google's deleted API keys kept working for up to 23 minutes. We measured what actually sets that window across eight independent caches, and why the number most teams would guess is half the real one.
Sorower
ASP.NET Core API key authentication: the filter that never ran
Run dotnet new webapi on .NET 10 and you get Minimal APIs with no controllers. The API key filter attribute every tutorial hands you does nothing there, and nothing warns you.
Sorower
API key format validation: what a checksum actually buys you
The received wisdom is that a checksum lets you reject bad API keys without hitting your database. I benchmarked it, and the saving is not where anyone says it is.
Sorower
Rate limiting failed authentication: the flood nobody counts
Your per-customer rate limiter sits behind authentication, so it never counts the requests you most want to stop. Here is the measurement, the fix, and the paying customer the fix locks out.
Sorower
Fastify API key authentication: the hook that guards nothing
Registering your API key check as a Fastify plugin can protect nothing outside that plugin. Three traps measured on Fastify 5.11.2, and what to do about each.
Sorower
Next.js API key authentication: the matcher that skips your API
The negative matcher in the Next.js docs excludes /api, so a key check in proxy.ts never runs on your API routes. Measured on Next.js 16.2.12, plus where the check actually belongs.
Sorower
Unkey alternatives in 2026: what each one actually replaces
Most “Unkey alternatives” lists hand you a reverse proxy and call it a swap. Here is what each option actually replaces, what it costs, and how much you would have to rewrite.
Sorower
Axum API key authentication: layer, route_layer, and order
The twelve-line Axum auth middleware works. Then route_layer quietly hands strangers a route scanner, and ServiceBuilder reverses your layer order. Four probes against Axum 0.8.9.
Sorower
Rate limit by API key, not IP: what four frameworks do by default
A brand-new customer's very first API call came back 429, because somebody else had already spent the bucket from the same IP address. Four frameworks, four probes, and the fix for each.
Sorower
Laravel API key authentication: your throttle already ran
A fresh Laravel 13 install ships no routes/api.php. Then it gets worse: your throttle middleware runs before your API key middleware, so every customer shares an IP bucket.
Sorower
How to hash API keys (and why bcrypt is the wrong tool)
bcrypt turns API key lookup into a full table scan, and past 72 bytes it will verify the wrong key as the right one. Both failures measured, plus the pattern that replaces it and how to migrate when you can't rehash.
Sorower
NestJS API key authentication: guard, middleware, or interceptor?
Every NestJS tutorial puts API key validation in a guard and stops there. The layer you pick decides your status codes, your usage bill, and whether a stranger can map your routes.
Sorower
Django REST Framework API key authentication without a user row
Checking an API key in a DRF permission class leaves request.user anonymous on a 200 response, which quietly turns your per-customer rate limit into a per-IP one. Here is the authentication class that fixes it, and the 401 you are probably returning as a 403.
Sorower
Spring Boot API key authentication and the filter bean trap
Declaring your API key filter as a @Bean registers it twice: once in your security chain and once with the servlet container. Measured results, the four-line fix, and the four things that break after your first customer.
Sorower
API credit pricing: how to decide what one credit is worth
Most API pricing posts hand you a taxonomy of models and stop before the arithmetic. This is the seller's side: cost per route, the credit unit, whole-number weights, and the one margin number that actually protects you.
Sorower
Golang API key authentication middleware: the parts tutorials skip
The twelve-line API key middleware everyone ships is fine until customer number two. Here is what to build after it in Go, including the ResponseWriter wrapper that silently breaks streaming and the route label your auth layer cannot see.
Sorower
API key management platform comparison: what 6 tools actually cost
Six platforms priced against the same one million API requests a month, from each vendor's own page: Unkey, Kong, Zuplo, Moesif, Treblle and ReqKey. Same traffic, a 46x spread in bills.
Sorower
Express API key authentication middleware, past the hardcoded array
Every Express API key tutorial stops at an array of strings and a comparison. Here are the three Express-specific traps that break it before you reach the database, and the four things it needs to survive real customers.
Sorower
FastAPI API key authentication that survives real customers
Every FastAPI API key tutorial ends at a hardcoded list and a warning not to ship it. This is the next paragraph: storage, lookup, revocation, and the FastAPI 0.122.0 change that breaks the tests those tutorials teach you to write.
Sorower
Per-user rate limits for MCP servers: your 429 is invisible
OAuth hands your MCP server a verified subject claim. It does not hand you a counter. What to meter, where to hang it, and why the model on the other end never sees your 429.
Sorower
Your API credit system bills before it knows the request worked
Credits are deducted at the gate, before your handler runs. That one structural fact drives every refund ticket, double-charge and reconciliation gap in a metered API. Here is the policy, the code and the honest trade-offs.
Sorower
Fail open or fail closed? What your rate limiter does when Redis dies
A Redis failover took eleven seconds. The API returned 500s for four minutes. Most teams never chose what their rate limiter does when its store is unreachable, and the ones who did chose it once, globally, for routes that need different answers.
Sorower
Multi-tenant API quotas: where the limit actually belongs
A customer on a 1,000-credit plan had somehow used 4,300, and nothing was broken. Where a multi-tenant API quota lives (the key, the user, or the account) decides what you can bill and what a key rotation breaks.
Sorower
Your 429 Too Many Requests response is probably wrong
Most 429 responses ship a bare status code and a guessed Retry-After. Here is what the header should actually say, the RateLimit fields that replaced the old three-header pattern, and when a 402 is the more honest answer.
Sorower
API key rotation without downtime: a provider's guide
Most API key rotation advice is written for the side that consumes the key. This is the other side: how to rotate a key you issued to a customer, prove it is safe to revoke, and keep their usage balance intact.
Sorower
Build an atomic sliding-window rate limiter in Redis and Lua
Most Redis rate-limiter tutorials embed the Lua in a Node or Python client. Here's the atomic sliding-window version — and how to run it at the edge in OpenResty, where a limiter belongs.
Sorower