January 2023 Summaries

Plain, a customer support tool for developer-focused products, is built with an API-first approach, ensuring that the public API is as robust and unrestricted as the internal one. This design choice, though challenging, allows customers to create custom integrations and features, enhancing extensibility. Plain's API is based on GraphQL, selected for its suitability in handling complex applications, despite some ecosystem limitations, such as error handling and support for complex input types. The company emphasizes a strong Developer Experience (DevEx), with tools like Customer Cards, which invert the typical data flow by fetching customer data from users' systems. Plain is committed to refining its DevEx, planning to introduce SDKs for easier integration and to improve the API experience. While they currently rely on qualitative feedback over metrics, the company values detailed feedback from its developer-centric customer base. Looking forward, Plain aims to tackle complex customer support challenges, such as triaging and queue management, while expanding its team and customer base.

Speakeasy has enhanced its SDK generator by adding support for OpenAPI webhook definitions, ensuring webhooks are treated with the same importance as other API endpoints and improving the Developer Experience. This update allows Speakeasy to generate types for webhook request and response objects, promoting a consistent user interface for API interactions. Additionally, Speakeasy has introduced small improvements, such as support for any router based on http.ServeMux to facilitate request and response logging and a "does not contain" filter in the request viewer for better log filtering. These enhancements aim to streamline the integration and management of webhooks in API strategies.

The blog post explores various methods of API authentication, emphasizing the trade-offs between them, and introduces a novel approach adopted by Speakeasy. It discusses common authentication methods, including opaque tokens, OAuth 2.0, public/private key pairs, and signed tokens, each with its pros and cons related to speed, ease of integration, and security. Speakeasy's innovation involves using signed tokens as API keys with a unique signing key for each API key, addressing the challenges of token revocation and security while maintaining ease of use similar to shared secrets. The implementation involves asymmetrically signed JWTs, a JWKS URI for public key exposure, and ensures API gateways maintain short-lived caches of these public keys to enhance security and scalability. The post concludes with performance benchmarks using Envoy and Google Endpoints, demonstrating the effectiveness and scalability of this approach for modern API applications.

Speakeasy simplifies the process of updating APIs by automating the generation and versioning of SDKs, eliminating the need for manual updates across various client libraries and reducing the risk of inconsistencies and migration challenges. By leveraging Speakeasy's GitHub workflow and action, new SDK versions are automatically created whenever an OpenAPI spec is updated, with commits made on a PR branch and a GitHub release upon merging. This automation extends to publishing on package managers, offering a seamless, end-to-end solution for managing SDK updates and ensuring consistency across different programming languages.

Nolan Sullivan discusses the release of a new CLI tool that incorporates an OpenAPI validator designed to simplify the process of debugging and optimizing OpenAPI specifications for code generation. This update aims to eliminate the challenges developers face when sifting through extensive YAML files by providing clear, actionable error and warning messages complete with line numbers. The validator not only enhances code generation workflows but also makes troubleshooting more efficient by distinguishing between bad practices and actual violations of the OpenAPI spec. Users can easily access this functionality by installing the CLI and using specific commands to validate their OpenAPI files.

The interview with Jack Flintermann Reed, an engineer at Increase, explores the strategic decisions and challenges around API development and developer experience (DevEx) at the company. Increase offers a REST API to developers, having previously experimented with GraphQL, but found REST more user-friendly due to its simplicity and the universal availability of HTTP clients. The company focuses on minimizing dependencies in its SDKs to facilitate ease of use, drawing from Reed's experience at Stripe. OpenAPI is used for documentation and client generation, albeit with reservations about its complexity. Increase prioritizes a strong developer experience by investing in high-quality documentation and a sandbox environment, which helps developers integrate quickly while complying with banking regulations. The conversation touches on the evolving landscape of API DevEx, the influence of Stripe as a benchmark, and the increasing democratization of API product quality, suggesting a future where off-the-shelf solutions may simplify the development process.