APIs
Bearer Tokens and Refresh Flows in Go APIs Explained
Build short-lived JWT access tokens and rotating refresh tokens in Go: pinned verification, hashed storage, reuse detection and a concurrent refresh trap.
13 min read
Tag
security
6 articles
APIs
Quotas and Usage Metering in Go APIs Done Correctly
Meter API usage and enforce quotas in Go: an atomic conditional UPDATE, idempotent events, weighted routes, refunds for 5xx, UTC periods and reconciliation.
18 min read
APIs
API Keys in Go and How to Generate Hash and Rotate Them
Generate, store and rotate API keys in Go: a prefixed format with a checksum, SHA-256 storage, throttled last-used, overlap rotation and 85 ns rejection.
13 min read
APIs
Rate Limiting Go APIs per API Key and per Route Cleanly
Rate limit a Go API per key and per route with token buckets: weighted costs, 429 with Retry-After, idle sweeping, a fake test clock and 123 ns decisions.
13 min read
APIs
Authentication for Go APIs With Keys Tokens and Sessions
Build Go API authentication with one Principal and three mechanisms: hashed API keys, signed bearer tokens and cookie sessions, with 401 versus 403 and CSRF.
19 min read
APIs
OAuth 2 Server Basics in Go for Your Own API Clients
Build a small OAuth 2 server in Go: client credentials, authorization code with PKCE, exact redirect matching, single-use codes and a scope-checking API.
21 min read