SecurityAPI Design
Token Exchange at the API Gateway: RFC 8693 in Practice
OAuth token exchange (RFC 8693) lets your API gateway hand the producer a token that still carries the user, so RBAC keeps working. Hands-on with Keycloak.
15 min read
API Design
API design patterns and best practices
API DesignResilience
AI Gateway: Cost Control, Failover, and New Risk
An AI gateway centralizes routing, budgets, and credentials for LLM traffic, but it also becomes a critical-path dependency with its own outage risk.
15 min read
API DesignArchitecture Practices
Fastify: Express Yourself, But Make It Lightning Fast
Fastify delivers 2x the throughput of Express with lower P99 latency, schema-based validation, first-class TypeScript support, and a plugin system built for encapsulation. Here is what makes it worth the switch and how to migrate without a full rewrite.
16 min read
API DesignArchitecture Practices
Server-Sent Events: The Humble Hero Between REST and WebSockets
Server-Sent Events give you HTTP-native server push without the cost of WebSockets. When to reach for SSE, and how to stream it from ASP.NET Core.
12 min read
API DesignSecurity
Model Context Protocol: Teaching Your AI to Actually Read the Room
MCP fixes the biggest lie in enterprise AI: that your language model actually knows your data. By providing a standardized client-server protocol for connecting AI systems to real data sources and tools, it eliminates the hallucination problem at its root, while introducing new architectural and security challenges that architects can't afford to ignore.
27 min read
Design PatternsAPI Design
The BFF Pattern: Friendship Goals for Frontend and Backend
The BFF pattern gives each frontend its own backend, so mobile, web and TV stop fighting over one shared API. When to use it, and when it is just overhead.
7 min read