#api
Posts tagged #api on Dynamo Geeks: 10 posts from the community, most useful first.
Posts tagged #api
System design primer: design a rate limiter, with real numbers
Most rate limiter answers I hear in mocks are one box on a diagram labelled "rate limiter" and then the candidate moves on. That box is the whole question. Let us do it properly, with numbers. Thanks to Kenji for reviewing the draft. 1. Requirements (spend 5 minutes here) Public API behind a gateway. 10 million daily active users. Limit: 100 requests per user per minute. Some endpoints (login, OTP) much stricter.…
the invoice IDOR that paid for my holiday, and the 94 days it took to fix
this is a writeup of a bug I reported to a SaaS billing vendor I am calling "Facturo" here (not the real name, the program is private and I am still under their disclosure terms). nothing in this post lets you attack them or anyone else. it is a plain IDOR, the oldest bug in the book, and the only reason it is interesting is the 94 days it took them to admit it. the setup Facturo is a billing dashboard that a few…
Daraja STK Push from Android: 10 things the docs will not tell you (with Kotlin)
Sasa wasee. I wire up M-Pesa for a logistics startup in Nairobi, from Eldoret. Safaricom's Daraja API works, but the docs leave a lot for you to discover at 2am. Here is my list. Maze, read it before you start. 1. Never call Daraja from the app A consumer key and secret inside an APK is a gift to every bored teenager with apktool. App calls your backend, backend calls Daraja. No exceptions, not even "just for the…
Idempotency keys in Go: the version that survives a double tap and a dead inverter
Customer taps Pay. The request goes out on a 3G connection in Onitsha, reaches our API, the charge succeeds, and the response dies somewhere on the way back. The app sees a timeout and retries. Without protection, that is two charges and one very angry customer calling the merchant, who calls us. Same thing happens when NEPA takes light in the middle of a request and the client's inverter takes three seconds to kick…
Idempotent payment endpoints in Go and Postgres: the pattern that stopped our double charges
For six months we refunded somebody almost every Monday. Same story every time: customer on a bad connection taps Pay, the request reaches us, the PSP charges them, our response never reaches the phone, the app retries, we charge again. This is the pattern we use now. Zero double charges since February. The rules Every POST that moves money requires an Idempotency-Key header. No key, 400. The client generates it…
Building APIs for users on 2G, prepaid data and phones from 2017: 20 things I learned the expensive way (1/20)
1/ Your users pay for every megabyte. Prepaid, in a currency that may have lost value this year. Every KB your API sends is money out of their pocket. Start there and most of this thread follows. 2/ Test like your users live. Chrome's "Slow 3G" preset is a holiday. On a Linux box between your test phone and the internet: sudo tc qdisc add dev eth0 root netem delay 400ms 100ms loss 2% rate 400kbit # remove it again…
Stripe webhooks in Laravel: verify, queue, return 200, and stop double-fulfilling orders
Kids are asleep, so here's the webhook setup we've been running on an ecommerce client for two years. It came out of a Black Friday where we shipped some lucky customers two of everything. Not Cashier, plain stripe-php, because the client has a custom checkout. Why webhooks go wrong Stripe retries a webhook if you don't answer with a 2xx quickly, and it keeps retrying for up to three days. If your handler does the…
set the dishwasher to start at 3am because the regional…
set the dishwasher to start at 3am because the regional carbon intensity forecast said 41 gCO2/kWh then vs 212 at 6pm. housemate says i'm in a cult. fair. the cult has a free REST API and i've written a python script that texts me when the wind picks up
Nobody outside Africa understands why mobile money won. Let me explain. (a thread, 1/22)
1/ Every few months someone in a San Francisco podcast "discovers" that Kenyans pay for tomatoes with their phones and calls it leapfrogging. It was not magic and it was not an accident. It was a series of boring, specific decisions. Here they are. 2/ M-Pesa launched in Kenya in March 2007, run by Safaricom (Vodafone was a big shareholder). The original pilot was not even about payments. It was a way to repay…