Create accountLogin

Recent searches

No recent searches

Search options

Only available when logged in.
social.tchncs.de is one of the many independent Mastodon servers you can use to participate in the fediverse.
A friendly server from Germany – which tends to attract techy people, but welcomes everybody. This is one of the oldest Mastodon instances.

Administered by:

Server stats:

3.8K
active users

social.tchncs.de: AboutProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.3.7

#apidesign

2 posts2 participants0 posts today
Public
Miguel Afonso Caetano

"API keys are foundational elements for authentication, but relying solely on them is inherently a risky proposal.

Firstly, there’s the reality that API keys are not securely designed — they were never meant to be used as the sole form of authentication, and as such, they aren’t really built for the task. These keys can often be easily stolen, leaked, or, in some cases (especially if generated incrementally), outright guessed. An API key is suitable for tracking usage but is poor for security.

There is also the additional reality that keys in their default state lack some critical functionality. There’s not a lot of verification built-in for identity management, and what does exist offers very little in the way of granular access control.

Ultimately, solely relying on API keys is a mistake common with novice developers but frighteningly common even in advanced products.

Best Practices
Instead of relying heavily on API keys as a sole mechanism, combine those keys with additional approaches such as OAuth 2.0 or mTLS. Implement rigorous expiration and rotation policies to ensure that keys which are made public are only useful for a short amount of time. Consider more advanced approaches, such as IP whitelisting or device fingerprinting, to add another layer of security atop the API key process."

nordicapis.com/9-signs-youre-d

Nordic APIs · 9 Signs You're Doing API Security Wrong | Nordic APIs |API security anti-patterns are common. From overreliance on API keys to a lack of rate limiting to no encryption, we explore the top ones.
#API#APIs#APISecurity
Public
Developer Overheid

Hoe staat het ervoor met de API Design Rules van de Nederlandse overheid? Tim van der Lippe van @Logius schreef als beheerder van de standaard een blogpost met de nieuwste inzichten en ontwikkelingen.

Werk jij met API’s in het publieke domein? Blijf op de hoogte en lees de update hier 👉 developer.overheid.nl/blog/202

developer.overheid.nl · Status update API Design Rules | developer.overheid.nlOp woensdagmiddag 26 maart 2025 kwam het Kennisplatform API's bijeen om de laatste ontwikkelingen rond API's te bespreken.
#api#digitaleoverheid#softwaredevelopment
Public
Miguel Afonso Caetano

"The accompanying diagram is intended to help you quickly decide how to document an API, but particularly a REST API. The first split is just to make sure you are looking for the right kind of API.

Here is some more context to help you decide on an approach and get started."

gist.github.com/briandominick/

GistAPI Documentation Decision MatrixAPI Documentation Decision Matrix. GitHub Gist: instantly share code, notes, and snippets.
#API#APIs#APIDesign
Public
:mastodon: Mike Amundsen

"Affordance Aversion" : The bias that makes devs resist declarative, dynamic API models (like ALPS) in favor of rigid schemas and static interfaces.

Loss Aversion + Endowment Effect = Overvaluing predictability, fearing flexibility.

Want resilient APIs? Rethink the trade-offs.

#api360#APIDesign#ALPS
Public
Miguel Afonso Caetano

"Getting to this point isn’t unusual. Clients clearly think they’re making the call correctly, or else they would fix the endpoint themselves. Some misspellings are difficult to catch. The enum USER_RETREIVE may not be noticed from USER_RETRIEVE, especially if picking it from a list. Misspellings happen and they’re not always caught before making it to the contract. As an aside, that’s why it’s important writers routinely check development’s changes. This applies, too, to our testing calls in Postman, where manually entering endpoints and values are more pervasive.

The reason this isn’t caught is simple: We’re not expecting it.

For our testing, the call is made and we get results. We may even spot check some of them. But generally, results aren’t examined that closely. For instance, how often do you so carefully examine a returned list of 50 or 100 items? You check may check that the objects are complete but not that the list conforms to the search criteria.

The reason this happens is because of an intentional behavior on the server. This behavior is called Lenient Handling or Strict Handling."

robertdelwood.medium.com/under

Medium · Understanding Query Parameter Handling in REST CallsBy Robert Delwood
#APIs#RESTAPIs#Rest
Public
N-gated Hacker News

🎉 Breaking News: "Other" enum values are the new black holes of API design! 🚀 Witness as developers boldly add an "Other" option, only to find themselves tangled in a web of ambiguity! 👾 Experience the thrill of watching Microsoft Dev Blogs declare the obvious with a flair for repetition! 🔄
devblogs.microsoft.com/oldnewt #BreakingNews #APIdesign #OtherEnum #DeveloperChallenges #MicrosoftDevBlogs #HackerNews #ngated

The Old New Thing · API design note: Beware of adding an "Other" enum value - The Old New ThingWhat are you going to do when you add a new kind?
Public
Tim Maguire

🔍 Just wrote about API versioning strategies for your developer platform! From Semantic Versioning to different implementation approaches (URI, header-based, and query parameters), I break down the pros and cons of each method based on real-world experience.

#APIDesign #DeveloperExperience #SoftwareEngineering #API

Read more about crafting a robust API versioning strategy that works for both your team and third-party developers: tmaguire.net/blog/2025/02/25/a

Tim Maguire · API VersioningAs a product manager for SaaS applications, making platform updates is relatively straightforward. Features can be rolled out gradually using feature flags to ensure proper adoption and quality, and aspects like migration and versioning typically aren’t required. While SaaS documentation needs updating, it’s not as critical as updating developer documentation for API changes. In this article, I’ll provide a framework for versioning an API and sharing experiences of what has and hasn’t worked for me.
ExploreLive feeds
About