Blog

Insights sobre construção de SaaS em escala

Building SaaS Auth from Scratch

Authentication is the foundation of any SaaS application. In this post, we'll walk through how AtendePraMim implements session-based auth with iron-session, 2FA via TOTP, and magic links. We use iron-session with AES-256 encrypted HttpOnly cookies. No JWTs exposed to the browser. TOTP-based 2FA adds a second layer. The user scans a QR code with their…

ALAlexandre Awadallak

postguias

11 de abr.

Primeiros Passos com AtendePraMim

Bem-vindo ao AtendePraMim — o boilerplate SaaS full-stack em Next.js. Autenticação — E-mail/senha, magic links, login social, 2FA Multi-organização — Times, membros, convites, papéis Cobrança — Integração Stripe, planos, cotas, créditos E mais — Notificações, webhooks, servidor OAuth2, casos de suporte Clone o repositório Copie .env.example para .env e…

ALAlexandre Awadallak

postengineering

9 de abr.

Scaling Your SaaS with Redis

Redis is the Swiss Army knife of SaaS infrastructure. AtendePraMim uses it for four distinct purposes. Iron-session encrypts the session into the cookie itself, so Redis isn't needed for session data. But we use Redis to track active sessions for revocation. Sliding window rate limiting with INCR and PEXPIRE. Each endpoint has its own key prefix and limits.…

ALAlexandre Awadallak

postengineering

25 de mar.

Webhook signing with HMAC

Webhooks are inbound HTTP requests from third parties. Without verification, anyone on the internet can POST to your webhook endpoint and trigger work. HMAC signing is how you verify the sender. When a provider sends a webhook, it computes an HMAC-SHA256 signature over the raw request body using a shared secret, then includes the result in a header…

ALAlexandre Awadallak

postengineering

20 de mar.

Rate limiting strategies that actually scale

Rate limiting is deceptively simple. A naive counter-per-minute works in your test suite and breaks in production the first time a user opens ten tabs at once. A fixed window resets on the hour. That lets a single client burn their entire quota at 11:59 and then do it again at 12:00 — an effective 2x limit. Sliding windows smooth this by weighting the…

ALAlexandre Awadallak

postengineering

15 de mar.

Multi-tenant database design

Most SaaS products pick their multi-tenancy model once and live with it forever. The migration cost later is so high that teams build entire companies around the constraints of a decision they made in their first sprint. Every row carries orgid. One database, one schema, one set of connections. Cheap to operate and dead simple until you need a row-level…

ALAlexandre Awadallak

postengineering

10 de mar.

Background jobs with BullMQ

Most application bugs don't live in your API handlers. They live in the long tail of "send this email later" and "charge this card tomorrow" — background jobs where failures are silent and retries compound. Redis-backed, TypeScript-first, batteries included. Built-in delayed jobs, retries with exponential backoff, a dead-letter queue, and a clean API for…

ALAlexandre Awadallak

postengineering

5 de mar.

Stripe webhooks and idempotency

Stripe will retry every webhook at least once. Network blips, slow processing, a bad 5xx — all of them trigger another delivery. If you double-grant credits or double-send the "Welcome" email because two copies of the same event arrived, that's your bug, not Stripe's. event.id starts with evt and never changes across retries. Store it. On receipt, check…

ALAlexandre Awadallak

postsecurity

28 de fev.

Preventing SSRF in file uploads

SSRF — Server-Side Request Forgery — is the class of bug where your server makes an HTTP request on behalf of a user to a URL the user controls. The classic case: a profile-picture import feature that takes a URL and fetches the image. The attacker gives you http://169.254.169.254/ and suddenly your server is handing the cloud metadata endpoint to the…

Building SaaS Auth from Scratch

Primeiros Passos com AtendePraMim

Scaling Your SaaS with Redis

Webhook signing with HMAC

Rate limiting strategies that actually scale

Multi-tenant database design

Background jobs with BullMQ

Stripe webhooks and idempotency

Preventing SSRF in file uploads

Fique por dentro