Blog

Insights sobre construção de SaaS em escala

Designing OAuth2 scopes

Scopes are the access-control language of your API. Get them right and third-party integrations feel natural. Get them wrong and you're forever explaining to customers why the Slack bot can also delete their billing history. At minimum, split every resource into read: and write:. read:cases lets an integration list cases; write:cases lets it mutate them.…

ALAlexandre Awadallak

postsecurity

15 de fev.

Session cookies vs JWTs

For browser-facing authentication, the debate between stateful sessions and stateless JWTs has had a clear answer for years. Session cookies win. The reasons are not exciting. A stateful session can be revoked in one UPDATE. A JWT cannot — the signature remains valid until the expiry you baked into the token, unless you build an allowlist or blocklist, at…

ALAlexandre Awadallak

postguides

10 de fev.

i18n in the App Router with next-intl

Next.js 13 dropped the old i18n config, and the App Router replacement is next-intl. It works well. The rough edges are all in the first hour. Next 16 renamed middleware. next-intl's guide still says middleware.ts. Your file must be src/proxy.ts — createMiddleware(routing) is the same; the filename is the only change. Skip it and your page falls back to…

ALAlexandre Awadallak

postengineering

5 de fev.

Zero-downtime Postgres migrations

Every serious schema change wants to be three deploys. New teams routinely ship them as one, take down production, and learn the rules the hard way. ALTER TABLE users ADD COLUMN tier TEXT NOT NULL rewrites every row. Worse, pre-11 versions hold an ACCESS EXCLUSIVE lock for the duration — reads and writes both block. The safe version: Deploy 1: add column as…

ALAlexandre Awadallak

postengineering

28 de jan.

Observability without the enterprise price tag

You don't need a six-figure vendor contract to run a SaaS responsibly. You need structured logs, a handful of metrics, and enough tracing to follow one request end-to-end. Most of the rest is expensive noise. JSON over text. logger.info("user.signup", { userId, email }) over console.log("user signed up: " + email). Every log event becomes queryable, every…

ALAlexandre Awadallak

postguides

20 de jan.

Email deliverability for SaaS products

Sending email is easy. Sending email that the recipient actually sees is not. Every new SaaS team ships their first signup flow and then spends two weeks debugging why nobody is getting the confirmation email. SPF (TXT record) says which servers are allowed to send for your domain. DKIM (TXT record) cryptographically signs outgoing messages. DMARC (TXT…

Designing OAuth2 scopes

Session cookies vs JWTs

i18n in the App Router with next-intl

Zero-downtime Postgres migrations

Observability without the enterprise price tag

Email deliverability for SaaS products

Fique por dentro