Things I’ve learned while shipping backends.

Short notes on auth, payments, and API design — written the way I’d explain them to another engineer over coffee, not in a slide deck.

Role-aware auth that doesn’t fall apart

“Logged in” is not a permission model. Here’s how I think about OTP, JWT sessions, and multi-actor APIs when the product actually has to ship.

Read this note

All notes

Payment UIs lie. Network drops, double taps, delayed redirects — if you credit wallets from the client, you will eventually pay someone twice.

18 Feb 20266 minPayments

A growing API doesn’t become a monolith overnight — it becomes one the week you “just put it in AppService for now.”

28 Jan 20265 minNestJS