The Dirty Secrets of Building Large, Highly Available, Scalable HTTP APIs
summary
Auth0’s evolution from a quick Express MVP to a production HTTP API: they introduced Swagger-generated documentation, added JSON schema validation and stable error codes, replaced client secrets with JWTs signed with HS256 plus a revocation mechanism, and implemented per-client token-bucket rate limiting. They also deployed geo-replicated data and services across regions and automated testing, migrations, and feature-switch rollouts; each change is described with the exact mechanism, open-source modules used, and whether it reduced incidents or caused regressions.
AI-written summary · about
chapters (10)
- 0:00API development context
- 1:29Express pitfalls
- 3:15Input validation
- 5:45Swagger auto-documentation
- 7:47JWT and OAuth2 auth
- 12:47Interaction time and raffle
- 13:30Rate limiting
- 16:18Geographic replication for HA
- 18:27API migration compatibility
- 20:15Deployment culture
related talks
22mThe dirty secrets of building large HTTP APIs
35mRoad to Efficient and Data-Driven DevOps
24mAPI Security in DevSecOps: Built-In, Not Bolted On
29mAccelerate API Innovation: Secrets to Staying Ahead
28mAPI Productisation - shift RIGHT to Better Product Resilience
37mAutomation++ - Building an Enterprise API Economy from scratch
18mScaling APIs to Billions: Extreme-Scale Reliability
29mStarting From Scratch