Don’t Lose Sleep, Secure Your REST
summary
LaunchKey replaces ad hoc crypto with JOSE (JWT JWE JWS JWK JWA) to sign and encrypt full requests and responses, move auth/validation into middleware, and cut endpoint delivery from days to ~20–30 minutes. The API scales from ~3,000 requests/hour to 10,000/minute, never gets compromised, and prevents replay by hashing jti until expiry. Key rotation uses kid and JWKS endpoint cached by clients, responses carry signed status headers and body hashes, and JWE combines RSA for keys with per-request AES content keys.
AI-written summary · about
chapters (32)
- 0:00Intro
- 2:14Auth and Crypto Was Messy
- 4:43Why Was It A Big Deal?
- 8:52Cryptography
- 10:20The Bad — Usability
- 12:38What Was Missing
- 13:48What Changed?
- 14:21The Good — Decoupling
- 16:42The Good — OSS Libraries
- 18:37The Good — Hierarchical Auth
- 21:38What is JOSE?
- 23:19JSON Web Token (JWT)
- 24:25JSON Web Signature (JWS)
- 25:36JSON Web Encryption (JWE)
- 27:52JSON Web Algorithm
- 28:08JSON Web Key
- 28:38Request Example Representation
- 29:40JWT Header Example
- 30:11Key Rotation
- 32:40Request Authorization
- 34:28Private Request Claims
- 35:03Hierarchical Credentials
- 35:51Timestamp and Duration
- 37:16Request Validation
- 40:44Private Response Claims
- 42:14Response Example Representation
- 42:36JWT Response Claims Example
- 44:02Response Validation
- 44:25Encrypted Data with JWE
- 45:40JWE Header Example
- 46:42Conclusion
- 48:22If You Want To Follow Up
