How to improve API performance? Here are 5 tips: 1. 𝗣𝗮𝗴𝗶𝗻𝗮𝘁𝗶𝗼𝗻 Pagination is a common optimization technique when result sets are large. By streaming results back to the client in pages, service responsiveness can be improved. 2. 𝗔𝘀𝘆𝗻𝗰𝗵𝗿𝗼𝗻𝗼𝘂𝘀 𝗟𝗼𝗴𝗴𝗶𝗻𝗴 Synchronous logging writes to disk on every API call, slowing down the system. With asynchronous logging, logs are first sent to a lock-free buffer and control is immediately returned. The buffer contents are then flushed periodically to disk, significantly reducing I/O overhead. 3. 𝗖𝗮𝗰𝗵𝗶𝗻𝗴 Frequently accessed data can be cached for fast retrieval. Clients can query the cache first instead of hitting the database directly every time. For cache misses, the database can be queried as a fallback. In-memory caches like Redis provide faster data access compared to databases. 4. 𝗣𝗮𝘆𝗹𝗼𝗮𝗱 𝗖𝗼𝗺𝗽𝗿𝗲𝘀𝘀𝗶𝗼𝗻 Request and response payloads can be compressed using algorithms such as gzip to reduce transmitted data volume. This speeds up upload and download times. 5. 𝗖𝗼𝗻𝗻𝗲𝗰𝘁𝗶𝗼𝗻 𝗣𝗼𝗼𝗹𝗶𝗻𝗴 Opening and closing database connections has significant overhead. Using a pool of open connections avoids this. The connection pool manages lifecycle events internally. What other performance optimization tricks have you found useful for APIs? – Subscribe to our weekly newsletter to get a Free System Design PDF (158 pages): bit.ly/496keA7

Understanding JSON Web Tokens (JWT) JWTs are a compact and self-contained method for securely transmitting information between parties as a JSON object. Let's break this down: 1. 𝗝𝗦𝗢𝗡 stands for JavaScript Object Notation - a lightweight data interchange format that is easy to read and parse. It is built on key-value pairs and array data types. 2. The 𝗝𝗪𝗧 𝘀𝘁𝗿𝘂𝗰𝘁𝘂𝗿𝗲 consists of three Base64-URL-encoded parts separated by dots (.) that form a serialized token: - The header contains the type (JWT) and the hashing algorithm used, e.g. HMAC SHA256. - The payload holds the claims, which are statements about the user and other data. - The signature is formed by encrypting the encoded header, encoded payload, and a secret. This is used to verify the sender and message integrity. 3. 𝗛𝗼𝘄 𝗝𝗪𝗧𝘀 𝘄𝗼𝗿𝗸: - The server creates a signed JWT upon user authentication and sends it to the client. - The client stores the JWT and includes it in the header of all requests to prove identity. - The server verifies the signature to grant access to protected resources. 4. 𝗦𝗶𝗴𝗻𝗶𝗻𝗴 𝗮𝗹𝗴𝗼𝗿𝗶𝘁𝗵𝗺𝘀: - With 𝗽𝘂𝗯𝗹𝗶𝗰/𝗽𝗿𝗶𝘃𝗮𝘁𝗲 𝗸𝗲𝘆𝘀, the JWT is signed with a private key and verified with the matching public key. - For 𝘀𝘆𝗺𝗺𝗲𝘁𝗿𝗶𝗰 𝗸𝗲𝘆𝘀, the same key signs and verifies the JWT so it must be kept secret. – Subscribe to our weekly newsletter to get a Free System Design PDF (158 pages): bit.ly/496keA7

Understanding OAuth 2.0 OAuth is an open standard that allows users to grant limited access to their data on one site to other sites or applications without exposing their passwords. It has become the backbone of secure authorization across the web and mobile apps. 𝗧𝗵𝗲 𝗢𝗔𝘂𝘁𝗵 𝗲𝗰𝗼𝘀𝘆𝘀𝘁𝗲𝗺 OAuth connects three main players: - The User who wants to grant access to their data without sharing login credentials - The Server that hosts the user's data and provides access tokens - The Identity Provider (IdP) that authenticates the user's identity and issues tokens 𝗛𝗼𝘄 𝗢𝗔𝘂𝘁𝗵 𝘄𝗼𝗿𝗸𝘀 When a user tries to access their data through a third-party app, they are redirected to log in through the IdP. The IdP sends an access token to the app, which presents it to the server. Recognizing the valid token, the server grants access. 𝗧𝗵𝗲 𝗢𝗔𝘂𝘁𝗵 𝗙𝗹𝗼𝘄𝘀 OAuth 2.0 defines four flows for obtaining authorization tokens: - Authorization Code Flow - for server-side applications - Client Credentials Flow - when the app is the resource owner - Implicit Code Flow - not secure and no longer recommended - Resource Owner Flow - for trusted apps using owner credentials 𝗞𝗲𝘆 𝗯𝗲𝗻𝗲𝗳𝗶𝘁𝘀 - Enhances user experience by eliminating multiple passwords - Allows secure data access across platforms using tokens - Balances accessibility and security OAuth 2.0 has become the standard for authorization. It enables secure, convenient data sharing while protecting user accounts. – Subscribe to our weekly newsletter to get a Free System Design PDF (158 pages): bit.ly/496keA7

Top 12 Tips for API Security - Use HTTPS - Use OAuth2 - Use WebAuthn - Use Leveled API Keys - Authorization - Rate Limiting - API Versioning - Whitelisting - Check OWASP API Security Risks - Use API Gateway - Error Handling - Input Validation – Subscribe to our weekly newsletter to get a Free System Design PDF (158 pages): bit.ly/496keA7

REST API Cheatsheet It covers: ✅ The six fundamental principles of REST API design ✅ Key components like HTTP methods, protocols, and versioning ✅ Practical tips on pagination, filtering, and endpoint design – Subscribe to our weekly newsletter to get a Free System Design PDF (158 pages): bit.ly/496keA7

A Visual Overview of Kubernetes Containers revolutionized modern application development and deployment. Unlike bulky virtual machines, containers package up just the application code and dependencies, making them lightweight and portable. However, running containers at scale brings challenges. Enter Kubernetes! Kubernetes helps deploy, scale, and manage containerized applications across clusters of machines. 𝗖𝗼𝗿𝗲 𝗞𝘂𝗯𝗲𝗿𝗻𝗲𝘁𝗲𝘀 𝗖𝗼𝗺𝗽𝗼𝗻𝗲𝗻𝘁𝘀 Control Plane: The brains behind cluster management, handling scheduling, maintaining desired state, rolling updates etc. Runs on multiple machines for high availability. Worker Nodes: The machines that run the containerized applications. Each node has components like kubelet and kube-proxy alongside the application containers. The smallest deployable units in Kubernetes are Pods. A Pod encapsulates one or more tightly coupled containers that comprise an application. Kubernetes assigns Pods to worker nodes through its API server. 𝗞𝗲𝘆 𝗞𝘂𝗯𝗲𝗿𝗻𝗲𝘁𝗲𝘀 𝗖𝗮𝗽𝗮𝗯𝗶𝗹𝗶𝘁𝗶𝗲𝘀 - Scalability: It's easy to scale applications up and down on demand. Just specify the desired instance count, Kubernetes handles the rest! - Portability: Applications can run anywhere - on premise, cloud, hybrid environments etc. No vendor lock-in! - Resiliency: Kubernetes restarts failed containers, replaces unhealthy nodes, and maintains desired state, reducing downtime. - Automation: Manual tasks like rolling updates, rollbacks are automated, freeing teams to focus on development. 𝗧𝗿𝗮𝗱𝗲𝗼𝗳𝗳𝘀 The power of Kubernetes comes with complexity. Installing, configuring, and operating Kubernetes has a steep learning curve. For many teams, it's overkill. Managed Kubernetes services help by handling control plane management, letting teams focus only on applications and pay for just the worker resources used. 𝗜𝘀 𝗞𝘂𝗯𝗲𝗿𝗻𝗲𝘁𝗲𝘀 𝗮 𝗚𝗼𝗼𝗱 𝗙𝗶𝘁? Consider: - Are you running containers already at meaningful scale? - Will portability or resiliency resolve production issues? - Is your team willing to invest in learning and operating Kubernetes? If you answered yes, Kubernetes may suit your needs. Otherwise, containers without orchestration may still get the job done. – Subscribe to our weekly newsletter to get a Free System Design PDF (158 pages): bit.ly/496keA7

REST API Cheatsheet It covers: ✅ The six fundamental principles of REST API design ✅ Key components like HTTP methods, protocols, and versioning ✅ Practical tips on pagination, filtering, and endpoint design – Subscribe to our weekly newsletter to get a Free System Design PDF (158 pages): bit.ly/3KCnWXq

Three pillars of observability: logging, tracing, and metrics. 🔹 Logging Logging involves recording discrete events within a system, such as incoming requests or database accesses. It typically generates high volumes of data. The ELK stack (Elasticsearch, Logstash, Kibana) is commonly used to build log analysis platforms. Implementing standardized logging formats across teams for efficient search in log datasets. 🔹 Tracing Tracing provides insight into the journey of requests across system components like APIs, load balancers, services, and databases. It is instrumental in identifying performance bottlenecks. OpenTelemetry offers a unified approach for implementing logging, tracing and metrics within a single architecture. 🔹 Metrics Metrics represent aggregate data points reflecting a system's operational state, including query rates, API responsiveness, and service latencies. This time-series data is collected in databases like InfluxDB and often processed by tools such as Prometheus, which supports querying and alerting based on specific criteria. Visualization and alerting on metrics can be done in platforms like Grafana, which integrates with various alerting mechanisms like email, SMS, or Slack. Which tools have you used for observability? – Subscribe to our weekly newsletter to get a Free System Design PDF (158 pages): bit.ly/496keA7

Symmetric vs Asymmetric Encryption Symmetric encryption and asymmetric encryption are two types of cryptographic techniques used to secure data and communications, but they differ in their methods of encryption and decryption. 🔹 In symmetric encryption, a single key is used for both the encryption and decryption of data. It is faster and can be applied to bulk data encryption/decryption. For example, we can use it to encrypt large amounts of PII (personally identifiable information). It poses challenges in key management because the sender and receiver share the same key. 🔹 Asymmetric encryption uses a pair of keys: a public key and a private key. The public key is freely distributed and used to encrypt data, while the private key is kept secret and used to decrypt the data. It is more secure than symmetric encryption because the private key is never shared. However, asymmetric encryption is slower because of the complexity of key generation and mathematical computations. For example, HTTPS uses asymmetric encryption to exchange session keys during the TLS handshake, and after that, HTTPS uses symmetric encryption for subsequent communications. – Subscribe to our weekly newsletter to get a Free System Design PDF (158 pages): bit.ly/496keA7

Top Architectural Styles In software development, the architecture you choose plays a key role in shaping a system's structure and behavior. It lays out a blueprint showing how different pieces will fit together to make the software work. Architectural styles offer proven solutions for common design challenges. They save time and effort while making more robust and maintainable systems. Still, with so many styles and patterns to pick from, it can be difficult to decide what approach works best for a given project. The architectural cheat sheet is handy for jogging your memory on the main features of common architectural styles and patterns. It can help navigate your options when designing software systems. – Subscribe to our weekly newsletter to get a Free System Design PDF (158 pages): bit.ly/496keA7

What Does ACID Mean? Below is a breakdown of the ACID properties, which are critical to the operations of database transactions. 🔹 Atomicity A transaction is a single unit of operation – either all its data modifications are performed, or none are. If a fault occurs during the transaction, all changes are rolled back as if the transaction never occurred. This "all or nothing" approach guarantees a database transaction is atomic. 🔹 Consistency Consistency refers to maintaining the database's integrity constraints. Any transaction will only transition the database from one valid state to another, adhering to predefined integrity rules. Unlike consistency in the CAP theorem relating to write visibility, ACID consistency focuses on the validity of transactions. 🔹 Isolation Isolation ensures concurrently executing transactions cannot view or interfere with each other's intermediate states. While complete "serializability" would run transactions sequentially, practical systems often necessitate weaker isolation levels that still protect integrity at better performance. 🔹 Durability Once committed, a transaction will persist even after system failures. This means changes are permanent and survive crashes. In distributed databases, durability involves replicating transaction data across nodes to prevent loss. – Subscribe to our weekly newsletter to get a Free System Design PDF (158 pages): bit.ly/496keA7

API vs SDK: Key Differences APIs (Application Programming Interfaces) and SDKs (Software Development Kits) are essential tools for software development, but they serve different purposes: 𝗔𝗣𝗜 An API is a set of rules and protocols that allows different software applications and services to communicate and share data. 1. Defines a standard interface for components to interact. 2. Allows integration between software written in different languages and frameworks. 3. Typically provides endpoints for requesting and serving data.. 𝗦𝗗𝗞 An SDK is a comprehensive package of tools, libraries, sample code, and documentation to simplify building apps on a specific platform, framework, or hardware. 1. Provides higher-level abstractions to ease development for a target platform. 2. Designed to integrate seamlessly with the underlying platform for compatibility and performance. 3. Grants access to platform-specific capabilities and features that may be complex to implement from scratch. The choice between APIs and SDKs depends on the project's goals and technical needs. APIs offer platform-agnostic interoperability, while SDKs provide convenient access to proprietary platform functionality. Over to you: Do you tend to use APIs or SDKs more in your work? – Subscribe to our weekly newsletter to get a Free System Design PDF (158 pages): bit.ly/496keA7

Top 12 Tips for API Security - Use HTTPS - Use OAuth2 - Use WebAuthn - Use Leveled API Keys - Authorization - Rate Limiting - API Versioning - Whitelisting - Check OWASP API Security Risks - Use API Gateway - Error Handling - Input Validation – Subscribe to our weekly newsletter to get a Free System Design PDF (158 pages): bit.ly/496keA7

How do companies ship code to production? The following describes a typical software delivery workflow. Companies have diverse environments using different tools. This is one representative workflow that demonstrates some common practices. Details will differ across organizations. With that context established, the general steps are as follows: Step 1: The product owner creates requirements and stories. Step 2: The development team prioritizes stories and organizes sprints. Step 3: Developers commit code to the version control system. Step 4: An automation server builds the code and runs tests. Code coverage and quality checks are performed. Step 5: If the build succeeds, artifacts are stored in the artifact repository. The build is deployed to the developer environment. Step 6: Features are tested independently in multiple isolated environments. Step 7: The QA team tests the features in QA environments. Various forms of testing are performed. Step 8: Once verified, the build is deployed to a user acceptance testing environment for final validation. Step 9: Release candidates that pass testing can be deployed to production based on the release schedule. Feature flags and incremental rollout techniques manage risk. Step 10: The site reliability team monitors production and reports issues. Teams prioritize and fix issues according to defined policies. How does your organization's software delivery workflow differ from the process outlined here? What tools and techniques have you found most effective? I'm interested to hear about the various approaches across the industry. – Subscribe to our weekly newsletter to get a Free System Design PDF (158 pages): bit.ly/496keA7