Engineering notes
How BuildAPI works underneath, what we got wrong, and what we changed. Written by the people who broke it.
What we log, and what we deliberately do not
A licensing gateway sees a lot of traffic. Most of it is none of our business.
Scopes in practice
When they earn their keep, when they are ceremony, and how to add them without a migration project.
Card or crypto: what changes
Both get you the same plan. They differ in renewal, refunds, and what happens when something goes wrong.
How to read a refusal
Nine reasons a call can be refused, what each one means, and what to actually do about it.
Domain verification is the product
Typing a domain into a field proves nothing. Proving you control it is the whole mechanism.
Why keys expire every thirty days
Not to annoy you. A key with no expiry is a key you can never really lose.
Proration done properly
Charging full price for a mid-cycle upgrade forfeits what the customer already paid. People notice once and never forgive it.
Why your call allowance is pooled, not per key
Adding keys does not add allowance. That is deliberate, and here is the reasoning.
Bot traffic is most of your traffic
On a small site with no audience, roughly half of what arrives is automated. Here is what that looks like and what to do.