What we built, a reusable production-readiness checklist, an honest list of what's still missing, and how to adapt all this to your own project. Series: Build a production-grade REST API in Go · Part
Docs rot. Here is how to publish an OpenAPI spec and an interactive UI from the same binary, then make it impossible for the spec and the code to disagree without a test failing. Series: Build a prod
TLS stops anyone from reading the traffic. It can't stop your own client from sending the same order twice. How to make POST safe to retry, and why the key must be claimed inside the same database tra
Every password and token in this series still crosses the network as plain text. We add HTTPS, learn what a certificate actually proves, rotate certificates without a restart, and encrypt (and verify)
An attacker doesn't have to break bcrypt if they can simply try a million passwords. We add three more rate limits, each defeating a different attack, and look hard at the one that can be turned again
We know who the caller is. Now: what may they touch? Roles, ownership checks enforced in SQL, and why a 404 is sometimes more correct than a 403. Series: Build a production-grade REST API in Go · Par
Until now anyone who can reach the server can do anything. We add accounts, secure password storage, short-lived access tokens, and revocable sessions, and we look at the attacks each design choice de
One client in a tight loop can starve everyone else. A token-bucket limiter protects fairness, the database, and your bill, if you identify clients correctly. Series: Build a production-grade REST AP
GET /users returns every user. That works until the day it takes the database down. Keyset pagination, the index that makes it fast, and three cheap wins. Series: Build a production-grade REST API in