Insights on building SaaS at scale
Scopes are the access-control language of your API. Get them right and third-party integrations feel natural. Get them wrong and you're forever explaining to customers why the Slack bot can also delete their billing history. At minimum, split every resource into read: and write:. read:cases lets an integration list cases; write:cases lets it mutate them.…
For browser-facing authentication, the debate between stateful sessions and stateless JWTs has had a clear answer for years. Session cookies win. The reasons are not exciting. A stateful session can be revoked in one UPDATE. A JWT cannot — the signature remains valid until the expiry you baked into the token, unless you build an allowlist or blocklist, at…
Next.js 13 dropped the old i18n config, and the App Router replacement is next-intl. It works well. The rough edges are all in the first hour. Next 16 renamed middleware. next-intl's guide still says middleware.ts. Your file must be src/proxy.ts — createMiddleware(routing) is the same; the filename is the only change. Skip it and your page falls back to…
Every serious schema change wants to be three deploys. New teams routinely ship them as one, take down production, and learn the rules the hard way. ALTER TABLE users ADD COLUMN tier TEXT NOT NULL rewrites every row. Worse, pre-11 versions hold an ACCESS EXCLUSIVE lock for the duration — reads and writes both block. The safe version: Deploy 1: add column as…
You don't need a six-figure vendor contract to run a SaaS responsibly. You need structured logs, a handful of metrics, and enough tracing to follow one request end-to-end. Most of the rest is expensive noise. JSON over text. logger.info("user.signup", { userId, email }) over console.log("user signed up: " + email). Every log event becomes queryable, every…
Sending email is easy. Sending email that the recipient actually sees is not. Every new SaaS team ships their first signup flow and then spends two weeks debugging why nobody is getting the confirmation email. SPF (TXT record) says which servers are allowed to send for your domain. DKIM (TXT record) cryptographically signs outgoing messages. DMARC (TXT…
Newsletter
Get new posts and changelog entries by email or RSS.