The Daily
A note a day on APIs and the realities of shipping web applications. Stuff I've actually learned across 25 years of doing the work.
Stripe Metered Billing: Building a Usage Ledger That Survives Out-of-Order Webhooks
Stripe's metered billing webhooks don't arrive in order. Here's how I built an idempotent usage ledger that doesn't double-charge customers when they don't.
Stripe's metered billing is genuinely useful until the first time you realize webhooks don't arrive in chronological order — and your usage ledger has silently double-counted 40% of a customer's API calls. I learned this the hard way building a usage-based billing system for a biotech client running genomics…
Read the daily →Docker Healthchecks That Actually Mean Something
Your container says healthy. Your app is throwing 500s. Here's why that happens and how to write healthchecks that actually gate traffic.
Your container is . Your app is throwing 500s on every request. Your load balancer is happily routing traffic into the void. Welcome to the false confidence of a default Docker healthcheck. I've debugged this exact situation more than once. Most recently on a Laravel app running behind Traefik for a healthcare client…
Read the daily →SSE over nginx + PHP-FPM: the buffering problem nobody warns you about
Server-Sent Events look dead simple until nginx and PHP-FPM start swallowing your stream. Here's what actually happens and how to fix it.
Every SSE tutorial on the internet shows you the same 15 lines of PHP and calls it done. What they don't show you is the part where you deploy to a real nginx + PHP-FPM stack and your beautifully streaming events arrive in one giant blob — or not at all — because three different layers are buffering your output…
Read the daily →Laravel Sanctum SPA Auth Across Subdomains Will Bite You
Sanctum's subdomain cookie auth looks simple until CORS and session config conspire to ruin your day. Here's the config that actually works.
Sanctum's documentation makes subdomain SPA authentication look like a ten-minute job. It is not a ten-minute job. I've set this up across probably a dozen projects now — e-commerce frontends on hitting APIs on , healthcare portals, a real estate dashboard — and every single time there's a moment where the cookie just…
Read the daily →The nginx directive that cuts PHP-FPM overhead in half
One keepalive line in your nginx upstream block and you stop paying TCP handshake tax on every PHP request. Here's why it's off by default and how to tune it.
I've tuned a lot of nginx configs over the years and I kept seeing the same thing: servers handling two or three hundred PHP requests per second with perfectly healthy CPU and memory numbers, but p99 latency sitting higher than it should be. The culprit, more often than not, was sitting right in the upstream block…
Read the daily →