May 2022 Summaries

Basis Theory introduced a public status page for monitoring its API, Portal, and Elements, expanded Reactors and Proxy to support all token types, and added flexible liquid-style expressions for accessing and processing token properties. The company also launched a Terraform Provider that enables infrastructure-as-code management of Basis Theory applications and Reactor formulas, alongside new setup guides and a Go SDK. Additional releases include a Slack community, Python SDK, token-property search, Basis Theory Labs, a community-built Ruby gem, documentation for major platform concepts, an official TabaPay reactor, a testing blog series, and the SendSecure.ly application. Platform improvements included expanded Card and Bank token endpoint support, deprecation of Atomic Card and Bank endpoints, OpenAPI and Swagger updates to simplify SDK and Postman collection generation, tenant member management APIs, and fixes for login, mobile portal display, styling, and Elements error handling.

Basis Theory’s testing series explains how load testing helps applications remain responsive and reliable during peak traffic by simulating user behavior before performance problems reach production. Load tests can target individual API operations or complete user journeys and can serve as performance tests for meeting service-level objectives, stress tests for identifying system limits and bottlenecks, or soak tests for detecting problems under sustained load. The team selected the open-source k6 framework because it supports local execution, JavaScript-based REST API tests, configurable traffic patterns, metrics export, CI/CD integration, and performance assertions. Using sendsecure.ly as an example, the post demonstrates a k6 test that repeatedly creates and retrieves secrets, records separate response-time metrics for each action, and enforces thresholds for failure rates and percentile response times. It recommends making tests reusable through environment variables and configurable virtual-user, iteration, and duration settings, while running performance checks in CI where practical and conducting stress or soak tests in production-like pre-production environments. The post also emphasizes carefully setting realistic thresholds, avoiding threshold creep, tracking metrics over time through tools such as Datadog, and combining load testing with acceptance, integration, UI, and synthetic testing to build confidence in system behavior and production readiness.

Basis Theory has launched Basis Theory Labs, a public hub created from an internal hackathon to showcase experimental tools, sample repositories, community projects, and partner integrations built around its data-security platform. The initiative reflects the company’s commitment to open source and building in public, while focusing on improving developer experience and demonstrating practical ways to use sensitive data safely. Initial projects include an Ansible lookup plugin for storing and retrieving CI/CD operational secrets through Basis Theory tokens, an Entity Framework ORM tokenization tool that adds automatic at-rest protection with minimal code, and Sendsecure.ly, an application for sharing secrets that are deleted after viewing or expiration. Although data remains stored in Basis Theory’s PCI Level 1 and SOC 2 compliant systems and tokens do not contain underlying values, Labs projects are working concepts that have not received production-level testing or support. Basis Theory invites developers to explore the documentation and GitHub organization, contribute projects, and collaborate through its community Slack.

Synthetic testing, or synthetic monitoring, simulates real user behavior from outside a deployed application to verify production availability, critical functionality, infrastructure, and dependencies before users encounter failures. In the Basis Theory testing series, sendsecure.ly uses Datadog Synthetic Tests configured with Pulumi and TypeScript to run health checks, multi-step API workflows that create and retrieve secrets, and browser tests covering the main UI flow across multiple locations, browsers, and devices. The approach emphasizes monitoring happy paths and system health rather than finding bugs, since production-discovered issues are more costly and exhaustive failure scenarios are better handled through acceptance and integration testing. Teams should select tools based on needed API and browser coverage, historical results, alert integrations, geographic testing, metrics, and cost, while balancing scheduled checks against deployment-triggered tests. The post also recommends carefully tuning test frequency, regional coverage, retries, and alerts to avoid unnecessary load and alert fatigue, concluding that synthetic tests provide confidence in an application’s ongoing production availability but do not yet address throughput, vulnerabilities, or resistance to common security attacks.

Part of Basis Theory’s testing series, this post explains how Cypress-based UI testing can increase confidence in browser-rendered web applications by evaluating user behavior, responsiveness, accessibility, and internationalization. It recommends behavior-driven acceptance tests that simulate user interactions in isolated environments, use intercepted API requests to control dependencies, and account for diverse user needs, languages, devices, and screen sizes. The post describes automated accessibility checks with Axe, locale-specific translation assertions, randomized viewport testing, and coverage of both successful and failure scenarios, including disabled controls, loading states, redirects, errors, and reusable test commands. It also emphasizes running acceptance tests locally, in pull-request CI pipelines, and when appropriate after merges to provide rapid feedback while managing test flakiness. Separate end-to-end integration tests run against deployed, production-like environments with real APIs, authentication, dependencies, and configurable secrets, focusing mainly on typical happy-path workflows and blocking promotion when failures occur. Together, these layers provide confidence in API and UI behavior and external integrations, while leaving availability, performance, vulnerability, and attack-resistance testing for later parts of the series.

Basis Theory’s testing approach prioritizes API acceptance tests over unit tests to provide fast, implementation-independent feedback while validating system behavior through public interfaces such as HTTP requests and responses. Acceptance tests treat applications as black boxes, focus on individual user-visible actions and outcomes, and use controlled mock servers, specification-compliant tools, Docker, and Docker Compose to isolate external dependencies in ephemeral environments. Tests follow Arrange-Act-Assert, or Given-When-Then, conventions and are run locally and in pull-request CI workflows through consistent automation, with post-merge execution depending on artifact and pipeline design. Integration tests similarly use public interfaces but run against deployed, production-like environments to confirm that applications communicate correctly with real external services, databases, and infrastructure, often testing full resource lifecycles. Configurable integration tests can target different environments and run after deployments or on demand, helping teams diagnose failures and block promotion when critical connectivity or behavior checks fail.

Basis Theory introduces a testing-series foundation describing how its eight-engineer team reportedly merged 3,353 pull requests over 12 months without customer-reported production issues by combining multiple testing layers and principles. Its “Swiss Cheese” approach includes unit, acceptance, UI, integration, synthetic, load, and security/compliance tests, each intended to catch different categories of defects from isolated code behavior to real-user workflows, performance, and vulnerabilities. The company emphasizes acceptance tests over unit tests for validating business behavior through public interfaces, along with small declarative tests, randomized test data, black-box testing, and deep-object equality assertions. It also advocates compiling software once into immutable artifacts that are promoted through environments, while using configuration-focused integration and operational tests after deployment, and argues that difficult acceptance testing can signal an overly complex product integration or design.

Basis Theory’s Terraform Provider enables engineers to manage Basis Theory resources through Infrastructure as Code, providing versioning, reusability, and automation for provisioning workflows. Built both for customers and for Basis Theory’s own management of shared public resources such as official Reactor Formulas, the provider reflects the company’s goal of integrating data-security tools into familiar developer workflows with minimal maintenance effort. It currently supports Applications, Reactors, and public or private Reactor Formulas, allowing users to create applications and use generated API keys in pipelines, deploy Reactors from formula IDs, and manage private formulas through Terraform. Basis Theory plans to expand support based on community feedback submitted through its open-source repository and is also exploring interest in integrations with other infrastructure tools, including Pulumi and Ansible.