The API Podcast with Fexingo: REST, GraphQL, and Modern Web APIs

The API Podcast with Fexingo: REST, GraphQL, and Modern Web APIs podcast cover
Fexingo Technology

The API Podcast with Fexingo: REST, GraphQL, and Modern Web APIs

Every week, Lucas and Luna sit down at a developer-focused office workstation to trace how applications actually talk to each other — not the hype, but the design decisions, trade-offs, and real-world failures that shape modern API architecture. Lucas, with a journalist's precision, lays out why a team chose REST over GraphQL for a payments pipeline handling 50,000 requests per second, or how a poorly designed endpoint caused a cascade failure in a major ride-hailing service. Luna, the engaged interlocutor, pushes back: when does schema flexibility become a liability? How do versioning strategies survive a decade of production use? Together, they dissect public postmortems, API design docs, and developer surveys — not to sell a tool, but to understand the engineering logic behind each choice. This show is for backend engineers, API product managers, and technical leads who need to decide, not just follow the trend. Expect no demos, no code walkthroughs — just two smart people reasoning about trade-offs in stateless design, pagination patterns, rate-limiting, and the cost of backward compatibility. By the end of each episode, you'll have a clearer framework for your own decisions: Should your next endpoint be a query or a mutation? When does an SDK become a maintenance burden? And how do you design an API that your colleagues will still respect five years from now?

#REST#GraphQL#WebAPIs#APIDesign#BackendEngineering#SoftwareArchitecture#APIVersioning#Microservices#HTTP#DeveloperTools#APIPostmortem#PlatformEngineering#Technology#FexingoBusiness#BusinessPodcast#Business#TechPodcast#SoftwareEngineering

Support Fexingo

Episodes

Latest 50 of 184 episodes

How API Backpressure Prevents System Collapses

Sep 12, 2026 · 10:09

We examine how the shift from synchronous REST calls to asynchronous event streaming exposes a critical flaw in modern architecture: the inability of downstream services to signal they are overwhelmed. Using the concept of backpressure, we explore why simply queuing requests is not enough and how protocols like gRPC and Kafka Streams allow systems to push back against demand before crashing. We also look at the specific failure modes that occur when APIs ignore consumer capacity, leading to…

0:000:00

How API Rate Limiting Shapes Fair Usage

Sep 11, 2026 · 10:24

We drill into the hidden economics of API rate limiting, using Stripe's sliding window algorithm as our anchor. In a market where compute costs are rising, how do companies balance protecting their infrastructure with preventing customer frustration? We break down why fixed windows fail, how token buckets work in practice, and what happens when you hit that forty-two percent throttle threshold on a busy Tuesday morning. #APIDesign #RateLimiting #StripeAPI #SlidingWindow #TokenBucket…

0:000:00

How API Idempotency Keys Save Money and Sanity

Sep 11, 2026 · 11:17

Every time a customer clicks buy now twice by accident, your payment processor charges you twice. That is not just a bug; it is a direct leak in your unit economics. In this episode, we look at how idempotency keys transform chaotic user behavior into deterministic system outcomes. We use Stripe's implementation as the primary case study because they treat idempotency not as an afterthought but as a core contract with developers. You will learn why storing the request body matters for…

0:000:00

How API Backpressure Prevents System Collapses

Sep 9, 2026 · 8:14

When a critical service spikes in traffic, does your system gracefully degrade or flatline? This episode explores the often-overlooked mechanism of backpressure in modern web APIs. We examine how companies like GitHub and Stripe implement flow control to protect downstream dependencies during traffic surges. Lucas breaks down the difference between passive rate limiting and active backpressure signals, while Luna shares an anecdote about a recent outage caused by ignoring upstream warnings.…

0:000:00

How API Schema Evolution Prevents Silent Data Corruption

Sep 8, 2026 · 9:08

Most developers assume that adding a new field to an API schema is harmless, but it can silently break downstream consumers or create data integrity nightmares. In this episode of The API Podcast, Lucas and Luna examine the specific mechanics of backward-compatible schema evolution using real-world examples from Stripe and Shopify. They explore why nullable fields are dangerous defaults, how strict typing prevents silent failures, and the critical role of contract testing in catching drift…

0:000:00

How API Authentication Prevents Identity Theft

Sep 7, 2026 · 10:36

API authentication is the gatekeeper of your digital infrastructure, yet many teams still rely on weak or misconfigured credential management. In this episode, we examine how modern OAuth 2.0 and OpenID Connect implementations protect user data from unauthorized access. We dive into specific cases where poor token handling led to massive breaches, exploring why short-lived access tokens and strict scope enforcement are non-negotiable for security. Lucas and Luna break down the mechanics of…

0:000:00

How GraphQL Solves Overfetching in Modern APIs

Sep 6, 2026 · 8:32

Lucas and Luna explore how GraphQL’s query language lets clients request exactly the data they need, eliminating the overfetching that plagues traditional REST endpoints. They break down a real-world e-commerce checkout flow where REST returns fifty fields but the UI only uses three, wasting bandwidth and latency. The hosts discuss schema design, resolver performance, and why this approach shifts complexity from the network to the server without breaking existing integrations. #GraphQL #REST…

0:000:00

How API Webhooks Prevent Data Overload

Sep 5, 2026 · 13:26

Webhooks are often treated as an afterthought in API design, leading to fragile integrations and wasted engineering cycles. This episode examines why event-driven architectures require a different reliability model than request-response APIs. We look at the specific mechanics of webhook delivery, focusing on how modern platforms handle retries, payload verification, and dead-letter queues to ensure critical data actually arrives. The discussion centers on the operational cost of failed…

0:000:00

How API Observability Turns Debugging Into Strategy

Sep 4, 2026 · 10:11

Most teams treat API monitoring as a fire drill, but leading engineering orgs use observability to drive product decisions. We explore how companies like Stripe and Shopify embed metrics into their development lifecycle, turning latency data into competitive advantages. This episode breaks down the difference between simple logging and true observability, focusing on distributed tracing and error budgets. You will learn why tracking user journeys matters more than server uptime and how to…

0:000:00

How API Resilience Patterns Save Systems

Sep 3, 2026 · 10:09

We explore how circuit breakers, bulkheads, and retry logic form the immune system of modern web infrastructure. Using examples from high-traffic platforms like Netflix and JPMorgan, we break down why relying on single-point solutions fails during peak load. This episode examines the specific mechanics of fault tolerance, including how to configure half-open states in circuit breakers and why idempotency is critical when retries trigger duplicate charges. We also look at the data behind latency…

0:000:00

How API Resilience Patterns Save Systems

Sep 2, 2026 · 10:24

Most developers treat error handling as an afterthought, but today we look at how circuit breakers and bulkheads actually save production systems from cascading failures. We use a specific case of a payment gateway outage to show why defensive coding matters more than optimistic design. You will learn the concrete difference between failing fast and failing gracefully, and why your next API integration needs these patterns built in from day one. This is not theoretical; it is about keeping your…

0:000:00

How API Contract Testing Prevents Broken Integrations

Sep 1, 2026 · 9:41

Most API teams treat integration testing as an afterthought, leading to costly outages when a backend change breaks a frontend expectation. This episode explores contract testing as the critical safety net that catches mismatches before they hit production. We examine how tools like Pact allow teams to define a shared agreement between service providers and consumers, ensuring that every deployment is validated against that strict schema. You will learn why mocking responses is insufficient for…

0:000:00

How API Rate Limiting Shapes Fair Usage

Aug 31, 2026 · 7:26

Lucas and Luna explore the quiet art of API rate limiting, a topic that touches every developer who has ever hit a 429 response. They look at how companies like Stripe and Twilio design rate limits to balance server costs, client needs, and fairness, using concrete examples like token bucket algorithms and burst allowances. The episode digs into the tension between protecting infrastructure and annoying users, and how smart rate limit design can actually improve developer experience. They also…

0:000:00

How APIs Enforce Consistent Data Validation

Aug 30, 2026 · 8:38

Every API call carries data, and if that data isn't validated properly, it can lead to security holes, corrupted databases, and angry users. In this episode, Lucas and Luna dive into the often-overlooked world of API data validation. They explore how JSON Schema, OpenAPI, and tools like Ajv and Zod are changing the game, and why strict validation on the server side is your first line of defense against bad actors and accidental bugs. They also break down the difference between syntactic…

0:000:00

How API Gateways Do the Heavy Lifting

Aug 29, 2026 · 10:29

Episode 170 of The API Podcast: Lucas and Luna dig into the API gateway pattern and the concrete problems it solves. Using examples like a food-ordering service and a bank's payment API, they explain how a single gateway layer handles authentication, rate limiting, request routing, and response transformation. They also unpack the subtle risks: centralizing logic can create a bottleneck, and misconfigured timeouts can take down a service. No hype, just the trade-offs you need to know before you…

0:000:00

How APIs Use Link Headers for Pagination and Discovery

Aug 28, 2026 · 11:07

In this episode of The API Podcast, Lucas and Luna dive into the Link header, a hidden but powerful HTTP feature that lets APIs advertise their own next steps. They explain how the Link header works, why it's more elegant than hardcoded URLs, and how it powers the discovery of both pagination and related resources. Using the GitHub API and RFC 5988 as anchor examples, they walk through the structure of a link value, the role of rel parameters, and show how clients can become more robust by…

0:000:00

How APIs Use the Prefer Header to Shape Responses

Aug 27, 2026 · 9:34

In this episode of The API Podcast, Lucas and Luna explore the Prefer header — the HTTP mechanism that lets clients politely ask for tailored response formats without creating messy custom endpoints. They break down how the Prefer header works with real-world examples: from asking a server to include additional fields, to requesting asynchronous processing for long-running operations, to signaling a preference for minimal responses that cut payload bloat. They walk through the specific header…

0:000:00

How APIs Use Caching to Cut Costs and Latency

Aug 26, 2026 · 11:25

Episode 167 of The API Podcast dives into API caching — a technique that slashes latency, reduces server load, and cuts cloud bills. Lucas and Luna break down the key concepts: cache headers like Cache-Control and ETags, the difference between private and shared caches, and how CDNs put data closer to users. They walk through a concrete example: how a news API serving 100 million requests a month can cut origin traffic by 70 percent with a simple cache policy, saving money and improving…

0:000:00

How APIs Use Versioning to Avoid Breaking Changes

Aug 25, 2026 · 12:02

API versioning is one of those topics every developer has opinions about, but few agree on the right approach. In this episode, Lucas and Luna dig into the real trade-offs between URI versioning, header versioning, and content negotiation, using Stripe's v1 and v2 APIs as a concrete case study. They walk through what actually happened when Stripe released its second API version, how it handled migration, and what lessons any team can steal—whether you're building a public API or an internal…

0:000:00

How API Design Prevents Webhook Overload

Aug 24, 2026 · 8:21

In this episode of The API Podcast, Lucas and Luna dive into a pervasive problem: webhooks that fire too much and overwhelm their consumers. They start with a real-world failure — a payment processor that pounded a merchant's endpoint with redundant notifications — and unpack the design flaws behind it. Lucas explains why webhook delivery should include idempotency, why senders need to honor retry-after headers and exponential backoff, and how consumer-side circuit breakers can stop a bad…

0:000:00

How APIs Use the Prefer Header to Shape Responses

Aug 23, 2026 · 9:26

In this episode, Lucas and Luna dive into the Prefer HTTP header, a powerful but often overlooked tool that lets clients ask for specific response behaviors from an API. They explore real-world uses like returning minimal representations, waiting for asynchronous processing, and handling pagination preferences. With concrete examples from major APIs like GitHub and Stripe, they explain how Prefer complements other standards like conditional requests and idempotency keys. The conversation also…

0:000:00

How APIs Use Backpressure to Prevent Overload

Aug 22, 2026 · 8:07

In this episode of The API Podcast with Fexingo, Lucas and Luna explore backpressure — the often-overlooked mechanism that keeps APIs from being overwhelmed by their own success. Using the example of a payment gateway that handles millions of transactions per day, they explain how backpressure works, why it matters more than ever in event-driven architectures, and how it differs from rate limiting and throttling. They discuss practical strategies like message queuing, circuit breakers, and load…

0:000:00

How API Query Languages Cut Payload Bloat

Aug 21, 2026 · 9:51

In this episode, Lucas and Luna dig into the practical problem of API payload bloat and how modern query languages like GraphQL and OData solve it. They use the case of a hypothetical e-commerce checkout flow to show how REST responses can carry twice the data you need, and how a query language lets the client ask for exactly the fields it wants. They also touch on the trade-offs: caching headaches, security risks, and the extra complexity on the server side. If you've ever felt your API…

0:000:00

How API Pagination Prevents Data Overload

Aug 20, 2026 · 9:39

In this episode of The API Podcast, Lucas and Luna dive into the world of API pagination—the unsung hero that keeps data flowing smoothly. They explore why Facebook's GraphQL API uses cursor-based pagination, how Stripe's list endpoints default to sensible limits, and why offset pagination can turn into a performance nightmare at scale. With real-world examples and practical tips, they explain the trade-offs between offset, cursor, and keyset pagination, and how to choose the right strategy for…

0:000:00

How APIs Use Bulkhead Isolation to Stop One Slow Client

Aug 19, 2026 · 7:59

In this episode of The API Podcast, Lucas and Luna explore the bulkhead pattern, a resilience technique that isolates API resources so one slow or failing client can't take down the whole system. They break down how Bulkhead works with real-world examples from finance and e-commerce, explain the difference between thread pools, semaphores, and circuit breakers, and share practical guidance on sizing bulkheads and handling rejected requests. If you're designing APIs that need to stay up under…

0:000:00

How Idempotency Keys Save Your API from Double Charges

Aug 18, 2026 · 10:39

In this episode of The API Podcast, Lucas and Luna dig into idempotency keys — the unsung heroes of reliable API design. You've probably used them without knowing: every time a payment gateway tells you to retry with the same key, that's idempotency at work. Lucas explains how idempotency keys work, why they matter beyond payments, and how Stripe made them a de facto standard. Luna brings up a real-world example: a double charge that happened on a ride-sharing app, and how the lack of…

0:000:00

How APIs Use Retry Strategies to Handle Transient Failures

Aug 17, 2026 · 10:32

On this episode of The API Podcast, Lucas and Luna dive into the art of retries in API design. They explore the difference between transient and permanent failures, explain why exponential backoff with jitter is a must-have, and walk through real-world examples like Stripe's default retry behavior and how idempotency keys prevent duplicate charges. They also tackle the tricky balance between client-side retries and server load, the role of Retry-After headers, and the dangers of retry storms.…

0:000:00

Why Your API Should Support Conditional GET Requests

Aug 16, 2026 · 11:03

In episode 157 of The API Podcast, Lucas and Luna dive into conditional GET requests and how they let HTTP caches skip re-sending unchanged responses. They walk through ETags and Last-Modified headers, explain the difference between 200 and 304 status codes, and show how adding a few headers can cut bandwidth and latency dramatically. Using real-world examples like a large e-commerce site's product catalog API, they discuss when conditional GETs make sense and when they don't, plus how to…

0:000:00

How APIs Use Content Negotiation to Serve the Right Format

Aug 15, 2026 · 10:53

When your API client asks for JSON but the server says XML, who wins? In this episode, Lucas and Luna dive into HTTP content negotiation — the quiet protocol powering everything from REST APIs to GraphQL. They walk through the Accept header, server-driven negotiation, and the Vary response header, using real examples like GitHub and Stripe. You'll learn why content negotiation is your API's best friend for versioning, caching, and serving multiple formats without breaking clients. Plus, they…

0:000:00

How APIs Use WebSockets for Real-Time Updates Over Polling

Aug 14, 2026 · 9:07

Episode 155 of The API Podcast: Lucas and Luna unpack why WebSockets beat REST polling for real-time apps. They trace the handshake that upgrades an HTTP request to a full-duplex socket, the reconnection logic that keeps dashboards alive, and the backpressure problem that trips up chat and trading UIs. Using a hypothetical live auction app as a running case, they show how a single persistent connection replaces dozens of HTTP calls per minute — and why that's not always the right trade. They…

0:000:00

How APIs Use Conditional Requests to Cut Unnecessary Data

Aug 13, 2026 · 10:16

Lucas and Luna dive into HTTP conditional requests — the powerful but often overlooked mechanism that lets APIs skip sending data when nothing has changed. They walk through how ETags and If-None-Match headers work, using a concrete example: a mobile news app polling a backend every five minutes. The episode explains the difference between validation and preconditions, shows how 304 Not Modified responses shrink bandwidth and latency, and warns about pitfalls like weak validators and race…

0:000:00

Why API Idempotency Keys Are Non-Negotiable

Aug 12, 2026 · 12:44

In this episode of The API Podcast, hosts Lucas and Luna dive into idempotency keys: the unsung heroes of reliable API design. They break down how idempotency keys prevent duplicate charges, retries, and data corruption, using real-world examples like Stripe's payment API and a flawed e-commerce checkout. Learn the anatomy of a well-implemented idempotency key, the pitfalls of naive caching, and why this pattern is critical for any system that faces network failures or user retries. Whether…

0:000:00

How API Versioning Strategies Prevent Breaking Changes

Aug 11, 2026 · 8:54

In this episode of The API Podcast, Lucas and Luna dive into the often-overlooked but critical topic of API versioning. They explore why choosing the right versioning strategy is essential for preventing breaking changes and maintaining a smooth developer experience. The discussion kicks off with the classic example of Stripe's API versioning approach, which uses date-based versions to balance innovation with stability. Lucas breaks down the pros and cons of URI versioning versus header-based…

0:000:00

Why Your API Needs a Rate Limit Strategy

Aug 10, 2026 · 8:42

In this episode of The API Podcast, Lucas and Luna dive into the art of API rate limiting—beyond the basics of token buckets and sliding windows. They explore why a one-size-fits-all approach fails in production, using real-world examples like a fintech app that hit a wall during a product launch. Discover how to set limits per user, per endpoint, and per plan, and why communicating limits through headers and error codes keeps developers happy. Learn from Stripe's and GitHub's approaches to…

0:000:00

How APIs Use Webhooks to Push Data in Real Time

Aug 9, 2026 · 9:59

In this special 150th episode, Lucas and Luna explore the world of webhooks: how they flip the API relationship from polling to pushing, and why that matters for real-time updates. They walk through a concrete example—a payment provider notifying a merchant's system the moment a transaction is authorized—and break down the anatomy of a webhook call, including payloads, signatures, and retry policies. The hosts compare webhooks to REST polling and GraphQL subscriptions, discuss delivery…

0:000:00

How APIs Use API Keys for Authentication and Rate Limiting

Aug 8, 2026 · 8:05

In this episode, Lucas and Luna unpack the humble API key — the most common yet often misunderstood authentication method in modern web development. They explore how API keys work under the hood, why companies like Stripe and GitHub still rely on them for granular rate limiting and per-project access control, and how keys differ from OAuth tokens. They also follow a real-world scenario: a startup's API team rolling out keys with scoped permissions and rotating them after a leak. The…

0:000:00

Why Your API Should Speak JSON Schema

Aug 7, 2026 · 8:31

JSON Schema is quietly becoming the contract layer for modern APIs, and in this episode Lucas and Luna break down why it matters right now. They start with a concrete case: a fintech team using JSON Schema to validate payment payloads before they ever hit the database, cutting bad requests by 30 percent. From there they unpack how JSON Schema gives you a single source of truth that powers validation, documentation, and mock servers — and how it complements OpenAPI rather than replacing it. They…

0:000:00

How APIs Use Async Patterns to Avoid Waiting

Aug 6, 2026 · 5:41

In this episode of The API Podcast with Fexingo, Lucas and Luna dive into asynchronous API patterns, exploring how long-running tasks can be handled without forcing clients to wait. They discuss the different approaches—from simple polling to webhooks and server-sent events—and use a relatable example: a video processing service that takes minutes to complete. The conversation highlights the trade-offs between each approach, including complexity, latency, and user experience. They also touch on…

0:000:00

How APIs Enforce Rate Limits Without Throttling the User

Aug 5, 2026 · 8:34

Rate limiting is everywhere in the API world, but most teams implement it badly. In this episode, Lucas and Luna dig into how the API team at Stripe, a payments company, approaches rate limiting for their public API. They break down why the classic token bucket algorithm creates a 'burst then cliff' experience, how Stripe's approach uses a leaky bucket with a rolling window to smooth out traffic, and what the '429 Too Many Requests' response actually means for the client. They also discuss the…

0:000:00

How APIs Use Problem Details for Standardized Errors

Aug 4, 2026 · 12:02

When an API returns an error, the client often gets a cryptic message and a status code — but no structured way to understand what went wrong or how to fix it. In this episode, Lucas and Luna dive into the Problem Details standard (RFC 9457), which gives errors a consistent JSON shape with fields like "type", "title", "status", and "detail". They explore a real-world example: a fintech API that adopted Problem Details to reduce support tickets and speed up client debugging. You'll learn how…

0:000:00

How API Design Tokens Keep Your UI in Sync

Aug 3, 2026 · 9:08

Design tokens are the single source of truth for colors, spacing, and typography across web and mobile. In this episode, Lucas and Luna unpack how Stripe's API-driven design system uses tokens to keep every client consistent, why versioning tokens matters more than versioning the API itself, and how a simple JSON schema can eliminate the drift between design and code. They walk through the anatomy of a token, the difference between primitive and semantic tokens, and the practical steps for…

0:000:00

How APIs Use Semantic Versioning without Breaking Clients

Aug 2, 2026 · 8:36

In this episode of The API Podcast, Lucas and Luna explore how APIs can adopt semantic versioning—known as SemVer—without breaking their existing clients. They start with a concrete case: a major cloud provider's API that moved from version 1 to version 2 while keeping backward compatibility. They break down the MAJOR.MINOR.PATCH structure, discuss when breaking changes are unavoidable, and share strategies like additive changes, deprecation headers, and parallel versions. They also touch on…

0:000:00

How APIs Use Distributed Tracing to Solve Modern Microservice Mysteries

Aug 1, 2026 · 7:26

In this episode of The API Podcast, Lucas and Luna dive into distributed tracing—the unsung hero of modern microservice debugging. They unpack why a single user request can fan out into dozens of service calls, how trace IDs and span trees help engineers see the whole picture, and the surprising cost of adding tracing headers to every request. With real-world examples like a checkout flow that mysteriously slows down, they show how tracing turns a confusing wall of logs into a clear map. They…

0:000:00

How GraphQL Cuts Over-Fetching and Under-Fetching

Jul 30, 2026 · 6:27

In this episode of The API Podcast with Fexingo, Lucas and Luna dive into GraphQL and how it solves two classic API frustrations: over-fetching and under-fetching. Using Shopify's Storefront API as a concrete case, they explain how GraphQL's type system and single-endpoint design allow clients to request exactly the data they need—nothing more, nothing less. They discuss the real numbers Shopify saw, including a 50% reduction in mobile payload sizes, and explore when sticking with REST still…

0:000:00

How Cursor-Based Pagination Beats Offset for Large APIs

Jul 30, 2026 · 6:49

When your API returns thousands or millions of records, offset pagination becomes a performance nightmare. Lucas and Luna compare offset vs cursor-based pagination, explaining why modern APIs like Stripe and Twitter rely on keyset pagination for consistent, fast queries. Learn the trade-offs and how to implement cursor-based pagination with MySQL or PostgreSQL using indexed columns. Plus: why GraphQL's connection spec uses cursors by design. #APIs #REST #GraphQL #WebAPIs #CursorBasedPagination…

0:000:00

How APIs Use gRPC for High-Performance Communication

Jul 29, 2026 · 7:05

Lucas and Luna dive into gRPC—Google's high-performance RPC framework that's transforming how APIs communicate. They contrast it with REST and GraphQL, explain Protocol Buffers vs JSON, walk through a real-world migration story at a major streaming service that cut latency by 40%, and discuss when you'd actually choose gRPC. Plus, they break down streaming RPCs, bidirectional flows, and how gRPC handles code generation for polyglot teams. No hype—just a clear look at a protocol that's quietly…

0:000:00

How APIs Use Structured Logging for Observability

Jul 29, 2026 · 7:42

When an API call fails or runs slowly, raw logs often bury the real cause. In this episode, Lucas and Luna walk through how structured logging — with correlation IDs, standardized log schemas, and distributed tracing — turns a firehose of text into searchable signals. They use Stripe's approach to debugging API requests as a concrete case: how a single correlation ID ties together a payment attempt across a dozen microservices. They also touch on OpenTelemetry's emerging standard and how…

0:000:00

How APIs Use Idempotency Keys for Safe Retries

Jul 28, 2026 · 5:23

In episode 137 of The API Podcast, Lucas and Luna explore idempotency – the unsung hero of reliable API design. They break down how idempotency keys prevent duplicate charges in payment systems, using Stripe as a case study. Learn the mechanics: client-generated UUIDs, server-side response caching, and expiration policies. Plus, how idempotency differs from concurrency control. Whether you're building a checkout flow or a critical write endpoint, this pattern is essential for safe retries.…

0:000:00

How APIs Use Token Bucket and Sliding Window for Rate Limiting

Jul 28, 2026 · 6:27

In this episode, Lucas and Luna break down the algorithms that power API rate limiting. Starting with Twitter's infamous API v2 rollout and GitHub's 5,000 requests per hour limit, they explore how token bucket and sliding window counters work under the hood. Learn why bursty traffic can bust fixed windows, how leaky buckets smooth out spikes, and what happens when you hit the limit—whether you get a 429 or a retry-after header. A concrete, no-nonsense look at one of the most fundamental yet…

0:000:00

How APIs Use OAuth 2.0 for Secure Authorization

Jul 27, 2026 · 7:27

Most API developers know OAuth 2.0 is the standard for authorization, but implementing it securely is where the real challenge lies. In this episode, Lucas and Luna break down the authorization code flow with PKCE, explain why the implicit grant is on its way out, and walk through the security gotchas that still trip up teams in 2026. They use GitHub's OAuth implementation as a concrete example, discuss refresh token rotation, and question whether your API should even issue long-lived tokens.…

0:000:00

Showing the latest 50 episodes. The full archive of 184 is on Apple Podcasts, Spotify and every major podcast app — or via the RSS feed above.