The Developer Tools Podcast with Fexingo: APIs, Infrastructure, and Software for Engineers

Lucas and Luna dig into why most API change logs are useless for developers. They break down how Stripe's changelog-as-spec approach lets teams automate dependency updates, catch breaking changes before they hit production, and reduce on-call alerts by 40%. They also explore the growing trend of machine-readable changelogs using OpenAPI extensions and why human-readable markdown isn't enough. Plus...

Episode 103 argues that the ubiquitous 'Try It' button in API documentation — a feature that sends a live request from the browser — is actually doing more harm than good for developer experience. Lucas and Luna explore how this convenience feature leads to confused state, broken workflows, and wasted time, especially for new users. They discuss real developer feedback from Stripe and Twilio, wher...

Episode 102 of The Developer Tools Podcast digs into a critical API design detail that most teams overlook: idempotency-key expiration. Lucas walks through a real incident at Stripe where an expired key led to double charges, and explains why the standard approach of keeping keys forever is actually a liability. He and Luna debate the tradeoffs between short TTLs and network retry reliability, the...

Most teams treat API documentation as a separate artifact from the software itself. Lucas and Luna examine why this mindset is broken. They walk through a concrete case from Stripe's developer portal, where every code sample runs through automated checks on every deploy. The episode contrasts that with the common scenario where docs hardcode outdated curl examples that silently rot. They discuss h...

In this milestone 100th episode of Developer Tools Podcast, Lucas and Luna dive into a deceptively tricky problem: ensuring backward compatibility in API changes. They use the real-world case of a payment processor that broke its own SDK by making a non-breaking change to an internal type — and how automated backward compatibility checking using tools like OpenAPI diff and contract testing could h...

In this episode, Lucas and Luna break down why most API pagination strategies are designed for the wrong use case. Using a concrete example from a dev-tools company that switched from offset-based to cursor-based pagination, they explain the hidden costs of each approach, when to use keyset pagination, and why 'just add limit and offset' can ruin your API's reliability and performance. Specifics i...

Most teams treat API design reviews as a human gate — a senior engineer or architect reviews your OpenAPI spec before you ship. But what if that gate is itself the bottleneck? In this episode, Lucas and Luna look at how companies like Stripe and Twilio have shifted toward automated design review tooling that catches structural issues before a human ever looks at the diff. They walk through a concr...

Lucas and Luna dissect why skipping an API design review before implementation leads to costly rework, broken contracts, and frustrated developers. They walk through a real-world example from a fintech startup that ignored design reviews and paid the price with a botched integration. The episode covers how design reviews catch issues like inconsistent naming, missing error codes, and security gaps...

Lucas and Luna dive into the difference between token bucket and leaky bucket rate-limiting algorithms, using the real-world example of GitHub's GraphQL API migration in 2022. They explain why token bucket handles sudden bursts better for modern API consumers, how Discord's rate limits caused a developer revolt in 2023, and why many APIs default to the wrong algorithm. Specific numbers: GitHub's o...

Episode 95 of The Developer Tools Podcast explores why most APIs ignore HTTP content negotiation — and the real cost of that choice. Lucas and Luna break down how Stripe and GitHub use Accept headers to version their APIs without breaking integrations, why large JSON payloads on mobile waste 60% of bandwidth on null fields, and how a single Accept header change on Twilio's API cut developer onboar...

Episode 94 of The Developer Tools Podcast examines the controversial practice of exposing stack traces in API error responses. Lucas and Luna debate the trade-offs between debuggability and security, using real-world cases like a 2024 GitHub API incident where verbose errors accidentally leaked internal service names, and contrasting it with Stripe's approach of including limited stack context via...

Episode 93 of The Developer Tools Podcast examines why traditional numeric API versioning creates hidden coupling and integration failures. Lucas and Luna walk through a real-world case from Stripe's API v2 migration in 2023–2024, contrasting it with GitHub's GraphQL approach. They discuss how version-pinned endpoints lock clients into brittle contracts, why semantic versioning misapplied to APIs...

Episode 92 of The Developer Tools Podcast explores why most API docs fail developers — not because they're incomplete, but because they lack empathy. Lucas and Luna unpack a real-world case: Stripe's documentation overhaul in 2024 that cut integration time by 40 percent by restructuring examples around end-user workflows instead of endpoint reference. They discuss the principle of 'audience-aware...

Lucas and Luna dive into the overlooked failure mode of WebSocket rate limiting. Most API rate limiting is built for HTTP request-response cycles, but WebSockets are persistent bidirectional streams — applying HTTP-style limits causes silent disconnects, missed messages, and unpredictable backpressure. They examine how Discord's gateway handles 120,000 concurrent WebSocket connections with per-con...

Lucas and Luna explore how seemingly minor API design decisions — like choosing between REST and GraphQL, deciding on pagination strategies, or selecting a serialization format — can compound into significant technical debt over time. They examine a real-world case: a mid-stage SaaS company that had to rewrite its entire integration layer after three years because its early API design favored flex...

Lucas and Luna dive into the hidden cost of bad API docs: the 'documentation to support ticket' ratio. They walk through how a major payment processor found that every percentage point of missing doc coverage generated $400K in extra support costs per quarter. Lucas explains why treating docs like code — with version control, automated testing, and a documentation SLO — is the only way to scale an...

Episode 88 of The Developer Tools Podcast with Fexingo dives into a common blind spot in webhook security: signature validation. Lucas and Luna dissect how most developers treat webhook verification as a checkbox rather than a chain of trust, using the 2024 Twilio breach as a concrete example. They walk through why HMAC-based signatures alone aren't enough, how replay attacks exploit timestamp gap...

API rate limit headers are supposed to tell developers how many requests they can make, but in practice they're a mess of inconsistent formats, conflicting semantics, and broken resets. In this episode, Lucas and Luna break down why the standard X-RateLimit-Remaining header is often wrong by design, why reset timestamps in Unix epoch are useless for production code, and why a simple 'Retry-After'...

Episode 86 of The Developer Tools Podcast digs into the hidden bandwidth tax of API response envelopes. Lucas and Luna examine how wrapping every response in a standardized envelope — with status codes, messages, and metadata — can inflate payload size by 30% or more, especially for high-throughput endpoints. They walk through real-world examples from Stripe and GitHub's APIs, contrasting envelope...

Every developer building payment systems has seen a duplicate charge disaster. The fix is idempotency keys, but most implementations leak logic errors that make them unreliable. Lucas and Luna break down exactly where idempotency-key design goes wrong — using Stripe's approach as the gold standard, with specific failure modes like the 'first write wins' vs 'last write wins' debate, key expiration...

Lucas and Luna explore a controversial idea: that error budgets, popularized by Google's SRE model, might actually be counterproductive for API developers. They examine how the standard 99.9% uptime target translates to 8.7 hours of allowed failure per quarter—and why that window often gets treated as a 'free pass' for bugs that degrade developer experience. The hosts drill into a real-world case:...

In this episode of The Developer Tools Podcast, Lucas and Luna dive into a subtle but pervasive problem in API design: rate limit headers that lie. They break down how common headers like X-RateLimit-Remaining can actually mislead developers into building unreliable integrations, and why some teams are switching to a token-bucket model with accurate leak rates. Along the way, they examine GitHub's...

Many engineering teams spend weeks hand-writing API client libraries for different languages — only to let them drift out of sync with the actual API. In this episode, Lucas and Luna dig into the case of Twilio, a company that generates client libraries automatically from its API specification. They walk through how Twilio's code-generation pipeline works, why hand-written clients introduce bugs a...

Episode 81 of The Developer Tools Podcast digs into API token rotation — why long-lived static access tokens are a security liability for modern APIs, and how major platforms like GitHub and AWS have pushed developers toward short-lived credentials. Lucas and Luna examine the trade-offs: reduced blast radius vs. increased complexity in client logic, the rise of OAuth device flows, and why many Saa...

Lucas and Luna dive into the often-overlooked failure mode of API webhook delivery SLOs. Using a real example from a payment processing platform that lost $2 million in recurring revenue due to a silent, gradual increase in webhook latency, they examine how engineering teams can be misled by average delivery metrics. They discuss tail latency, the dangers of percentile-based SLOs, and why the 99th...