Integration & API concepts
100 plain-English guides to the concepts behind a solid API integration — authentication, REST fundamentals, resilience patterns, webhooks and operations. Search or filter by topic.
- Auth & Identity
What Is OAuth 2.0?
A plain-English introduction to the OAuth 2.0 delegated authorisation framework.
6 min - Auth & Identity
What Is OpenID Connect?
How OpenID Connect adds standardised authentication on top of OAuth 2.0.
6 min - Auth & Identity
The Authorization Code Flow
Step-by-step look at the recommended OAuth flow for user-facing applications.
7 min - Auth & Identity
PKCE Explained
How PKCE protects the authorization code flow for mobile and browser apps.
6 min - Auth & Identity
The Client Credentials Flow
Using the client credentials grant for server-to-server API access.
6 min - Auth & Identity
Access Tokens vs Refresh Tokens
The distinct roles of access tokens and refresh tokens in OAuth 2.0.
6 min - Auth & Identity
What Is a JWT?
Understanding the structure and purpose of JSON Web Tokens.
6 min - Auth & Identity
Validating a JWT
The essential checks every service must perform before trusting a JWT.
7 min - Auth & Identity
JWKS and Key Rotation
How JWKS endpoints publish signing keys and enable smooth key rotation.
6 min - Auth & Identity
OAuth Scopes Explained
How OAuth scopes define and limit the permissions an access token carries.
5 min - Auth & Identity
Bearer Token Authentication
How bearer tokens authenticate API requests and how to handle them safely.
5 min - Auth & Identity
API Keys vs OAuth
Comparing static API keys with OAuth tokens and when to use each.
6 min - Auth & Identity
Token Expiry and Renewal
Designing clients to handle token expiry and renew access smoothly.
6 min - Auth & Identity
Securing Client Secrets
Best practices for storing, distributing, and rotating OAuth client secrets.
6 min - Auth & Identity
Mutual TLS Overview
How mutual TLS authenticates clients and can bind tokens to them.
6 min - Auth & Identity
Single Sign-On Basics
What single sign-on is and how OpenID Connect makes it work.
5 min - Auth & Identity
Consent and Authorization
Why user consent matters and how to request it responsibly.
5 min - Auth & Identity
Least Privilege for API Access
Applying the principle of least privilege to tokens, scopes, and credentials.
6 min - Auth & Identity
Common Auth Mistakes
A field guide to the most common OAuth and token-handling mistakes.
7 min - Auth & Identity
Choosing an Auth Flow
A decision guide for selecting the right OAuth 2.0 flow for your client.
6 min - API Fundamentals
What Is a REST API
A plain-English introduction to REST, resources, and why HTTP makes a good API foundation.
6 min - API Fundamentals
HTTP Methods Explained
What each HTTP method means, when to use it, and which ones are safe to retry.
6 min - API Fundamentals
HTTP Status Codes
How to read 2xx, 3xx, 4xx, and 5xx status codes and react to each class correctly.
6 min - API Fundamentals
Working With JSON
JSON's data types, common pitfalls, and how to parse and serialise it safely.
6 min - API Fundamentals
Request and Response Headers
The headers that matter most for authentication, content negotiation, and caching.
6 min - API Fundamentals
API Pagination
Offset versus cursor pagination, why cursors are safer, and how to walk every page.
6 min - API Fundamentals
Filtering and Sorting
How filter and sort parameters work, plus tips for encoding and combining them safely.
5 min - API Fundamentals
API Versioning
Common versioning strategies and how to pin a version so upgrades stay on your terms.
6 min - API Fundamentals
Idempotency Keys
What idempotency keys are, why retries need them, and how to generate and reuse them.
6 min - API Fundamentals
Rate Limiting Explained
How rate limits work, how to read limit headers, and how to back off gracefully.
6 min - API Fundamentals
Content Types and Encoding
Media types, UTF-8, and gzip compression — the plumbing that moves data correctly.
6 min - API Fundamentals
Query vs Path vs Body Params
Path, query, and body parameters compared — what each is for and when to reach for it.
5 min - API Fundamentals
Handling API Errors
Reading structured error responses and choosing the right reaction to each failure.
6 min - API Fundamentals
The OpenAPI Specification
What an OpenAPI document contains and how to put it to work in your own tooling.
6 min - API Fundamentals
Reading API Documentation
How to navigate reference docs, read endpoint definitions, and find what you need fast.
5 min - API Fundamentals
Designing Resource URLs
Conventions for clean resource URLs — nouns, plurals, nesting, and what to avoid.
6 min - API Fundamentals
Partial Responses and Fields
Using field selection and sparse responses to transfer less data and go faster.
5 min - API Fundamentals
Bulk and Batch Requests
When and how to use bulk endpoints and batched operations, and how to read partial results.
6 min - API Fundamentals
Caching and ETags
How HTTP caching, ETags, and conditional requests let you skip redundant downloads.
6 min - API Fundamentals
API Deprecation and Changelogs
Reading deprecation signals and changelogs so version changes never catch you out.
6 min - Integration Patterns
Synchronous vs Asynchronous Integration
Choosing between blocking request-response calls and decoupled asynchronous work.
6 min - Integration Patterns
Retry With Exponential Backoff
Retrying failed calls with growing delays and jitter to avoid overwhelming a service.
6 min - Integration Patterns
Handling Rate Limits
Respecting request quotas, reading limit headers and backing off on 429 responses.
6 min - Integration Patterns
The Idempotent Consumer
Designing operations and consumers so processing the same message twice is harmless.
7 min - Integration Patterns
Polling vs Webhooks
Comparing periodic polling against pushed webhook callbacks for receiving updates.
6 min - Integration Patterns
Sandbox and Testing
Using a sandbox to develop and test integrations without affecting live systems.
6 min - Integration Patterns
Environment Configuration
Managing per-environment settings so one codebase runs anywhere without edits.
6 min - Integration Patterns
Secrets Management Basics
Storing and handling API credentials safely, away from source control and logs.
6 min - Integration Patterns
Building a Resilient Client
Assembling timeouts, retries, backoff and breakers into a dependable API client.
7 min - Integration Patterns
Circuit Breakers
Using a circuit breaker to halt calls to a failing service and let it recover.
6 min - Integration Patterns
Request Timeouts and Deadlines
Setting per-request timeouts and end-to-end deadlines so calls cannot hang.
6 min - Integration Patterns
Pagination Strategies
Comparing offset and cursor pagination for reliably traversing large collections.
6 min - Integration Patterns
Data Synchronisation Patterns
Patterns for keeping data consistent between systems: full, incremental and event-driven.
7 min - Integration Patterns
Eventual Consistency
Understanding why distributed data is temporarily out of step and how to cope.
6 min - Integration Patterns
Integration Error Handling
Classifying API errors and responding correctly to client, server and network faults.
6 min - Integration Patterns
Logging API Calls
Capturing useful, safe log detail for outbound API calls and their outcomes.
6 min - Integration Patterns
Monitoring an Integration
Tracking the metrics and alerts that reveal an integration's health over time.
6 min - Integration Patterns
API Client Libraries and SDKs
Weighing SDKs, generated clients and direct HTTP for talking to an API.
6 min - Integration Patterns
Mapping Data Models
Translating between an external API's data shapes and your internal domain model.
6 min - Integration Patterns
Planning an Integration
A practical checklist for scoping and de-risking an integration before building it.
7 min - Webhooks & Events
What Are Webhooks?
An introduction to webhooks: server-to-server callbacks that deliver events as they happen.
6 min read - Webhooks & Events
Webhooks vs Polling
Compare push-based webhooks with pull-based polling and learn when each approach wins.
6 min read - Webhooks & Events
Designing a Webhook Receiver
Patterns for building a robust endpoint that accepts, validates, and processes webhook deliveries.
7 min read - Webhooks & Events
Verifying Webhook Signatures
How signature verification works and why every webhook receiver must check it before trusting a payload.
7 min read - Webhooks & Events
Handling Webhook Retries
Why providers retry failed webhook deliveries and how to build a receiver that handles repeats safely.
6 min read - Webhooks & Events
Webhook Idempotency
Make webhook handling idempotent so duplicate deliveries never corrupt your data or trigger side effects twice.
6 min read - Webhooks & Events
Ordering and Out-of-Order Events
Why webhook events can arrive out of order and how to process them correctly when sequence matters.
6 min read - Webhooks & Events
Replaying Missed Events
Strategies for recovering webhook events your endpoint missed during downtime, using replay and reconciliation.
6 min read - Webhooks & Events
Securing Webhook Endpoints
Layered defences for webhook endpoints: signatures, HTTPS, replay protection, and minimal trust.
7 min read - Webhooks & Events
Responding to Webhooks Quickly
Why prompt acknowledgement matters and how to keep webhook handlers fast by deferring heavy work.
5 min read - Webhooks & Events
Webhook Payload Design
Principles for designing clear, stable webhook payloads that consumers can rely on over time.
6 min read - Webhooks & Events
Event-Driven Architecture
An introduction to event-driven architecture and how webhooks fit into a wider event-based design.
7 min read - Webhooks & Events
The Outbox Pattern
How the transactional outbox pattern reliably emits events alongside database changes for webhook delivery.
7 min read - Webhooks & Events
Dead-Letter Queues
How dead-letter queues isolate events that repeatedly fail processing so they can be inspected and recovered.
6 min read - Webhooks & Events
Testing Webhooks Locally
Techniques for developing and testing webhook receivers locally using tunnels, fixtures, and simulated events.
6 min read - Webhooks & Events
Webhook Delivery Guarantees
Understand at-least-once, at-most-once, and exactly-once delivery and what each means for your receiver.
6 min read - Webhooks & Events
Subscribing to Events
How event subscriptions work: registering endpoints, selecting event types, and managing them over time.
6 min read - Webhooks & Events
Event Types and Schemas
How event types and their schemas form a contract between provider and consumer, and how they evolve.
6 min read - Webhooks & Events
Debugging Webhook Failures
A systematic approach to diagnosing webhook delivery and processing failures using logs and event ids.
6 min read - Webhooks & Events
Scaling Webhook Processing
How to scale webhook receivers to handle high and bursty event volumes without losing or delaying events.
7 min read - Reliability & Ops
Designing for Failure
Build integrations that expect failure: isolate, retry safely, and degrade rather than crash.
7 min - Reliability & Ops
Timeouts and Deadlines
Set explicit connect and read timeouts, propagate deadlines, and budget time across a request chain.
6 min - Reliability & Ops
Structured Logging
Log machine-readable events with consistent keys so you can filter, aggregate, and trace problems fast.
6 min - Reliability & Ops
Correlation IDs
Attach a request-scoped identifier and propagate it everywhere so you can trace one request across services.
5 min - Reliability & Ops
Observability Basics
Understand the three pillars — logs, metrics, traces — and how they combine to explain system behaviour.
7 min - Reliability & Ops
Metrics and Alerting
Track the signals that reflect user experience and alert on symptoms, not every internal fluctuation.
7 min - Reliability & Ops
Health Checks
Design liveness and readiness checks that report real serving capacity without causing false restarts.
6 min - Reliability & Ops
Graceful Degradation
Keep core functionality available when a dependency fails by shedding non-essential features on purpose.
6 min - Reliability & Ops
Handling Partial Failures
Reason about ambiguous outcomes — succeeded, failed, or unknown — and recover with idempotency and reconciliation.
7 min - Reliability & Ops
Data Validation at the Boundary
Validate and normalise external input at the system boundary so invalid data is rejected before it spreads.
6 min - Reliability & Ops
Securing Data in Transit
Use current TLS, verify certificates, and avoid downgrades so data is protected as it moves between systems.
6 min - Reliability & Ops
Securing Data at Rest
Encrypt stored data, manage keys carefully, and minimise what you keep to limit the impact of any breach.
6 min - Reliability & Ops
PII Handling Basics
Recognise personal information, collect only what you need, and protect it across its whole lifecycle.
7 min - Reliability & Ops
Audit Logging
Record security-relevant actions immutably so you can answer who did what, when, and from where.
6 min - Reliability & Ops
Rate-Limit-Friendly Clients
Read rate-limit signals, back off with jitter, and shape traffic so your client stays within limits gracefully.
6 min - Reliability & Ops
Capacity and Load Planning
Estimate demand, test against it, and provision headroom so load spikes degrade gracefully instead of breaking.
7 min - Reliability & Ops
Incident Response Basics
Run incidents with clear roles, steady communication, and a focus on restoring service before finding root cause.
7 min - Reliability & Ops
Postmortems and Learning
Run blameless postmortems that find systemic causes and produce tracked actions, so incidents are not repeated.
6 min - Reliability & Ops
Dependency Management
Pin versions, keep dependencies patched, and watch for vulnerabilities so third-party code stays an asset.
6 min - Reliability & Ops
API Security Checklist
A practical pass over authentication, secrets, validation, transport, and least privilege for integrations.
7 min
No concepts match. Try a different keyword or clear the filter.
Build against the Merion API
An OIDC-secured REST hub with a live OpenAPI spec and interactive reference.