apis
APIs
How programs talk to each other over the network — the main styles (REST, GraphQL, gRPC), and how to design one that stays usable as it changes.
Start track →Start from zero
Before the senior material: what an API even is, and the handful of words the rest of the track assumes you already know.Rest modeling
Modeling REST resources: nouns the client needs, not your verbs or tables
A REST API is a model of resources a client cares about. The two failures that hurt in prod: turning actions into verb…
Status codes real
Status codes that actually matter in production
A status code is a contract three machines read before any human does: caches, dashboards, and retry logic. Getting the…
Pagination
Pagination at scale: why OFFSET dies and keyset cursors survive
OFFSET makes the database scan and throw away every row before your page, so deep pages slow linearly and drift when…
Openapi
OpenAPI: making the contract the source of truth, not the docs
OpenAPI only pays off when the spec is enforced — generating clients, validating requests, and failing CI on breaking…
Grpc protobuf
gRPC and Protobuf: the binary contract and what it costs you
gRPC trades JSON''''s human-readable payloads for a schema-bound binary wire format that is 4-10x faster and far…
GraphQL N+1 and the cost of nested resolvers
Why GraphQL turns one HTTP request into 1000 database calls, how DataLoader fixes it with a single event-loop tick, and the complexity / depth / persisted-query controls that keep public APIs alive.Rate limiting
Rate limiting: algorithms, the boundary burst, and the Redis counter
Fixed window is cheap but leaks a 2x burst at the boundary; token bucket smooths it. The real production lesson is that…
Putting it together
Designing and reviewing a public API end to end
Every API decision is connected: bad resource modeling forces status-code abuse, which makes clients retry wrong, which…
Build with this track
Guided projects that exercise what you learn here.
Feature-flag service
Build a small flag service with targeting rules, percentage rollouts, and a typed SDK that evaluates flags client-side from a cached ruleset.
Mini CRUD API
Build your first real backend: a tiny HTTP API that creates, reads, updates, and deletes notes — backed by SQLite so the data survives a restart. You go from a one-line 'hello' server to a small service that validates input and stores rows, one honest step at a time.
Mini OAuth 2.0 + PKCE login
Implement the authorization-code + PKCE flow end to end against a real provider, so you understand every redirect and token instead of trusting a library.
Presigned upload flow
Direct-to-storage uploads via presigned URLs with size/content-type limits and a completion webhook that verifies the object actually arrived — so your API server never touches file bytes.
Distributed rate limiter
Build a token-bucket limiter that holds across many app instances by keeping the counter in Redis, not in process memory.
Todo CRUD with SQLite
Your second backend: a todos API where the todos live in SQLite, not memory — so they survive a restart and you learn what persistence actually costs.
Type-Safe API SDK
Build the client other engineers will actually trust: a typed SDK over a real HTTP API where the compiler — not a runtime crash in production — catches the wrong field, the missing variant, the response that lied about its shape. You model the domain with discriminated unions and generics, validate every response at the boundary, and let inference carry exact types all the way to the call site, with zero `any` left to paper over the gaps.
URL shortener at scale
Build a URL shortener that survives real traffic — then run it: deploy it, watch it, and work the incident when one hot link melts your cache.
Databases
How databases store and find your data fast, keep it correct when many users write at once, and grow as the data gets bigger.