Skip to content

The tools

Each tool has a page in the Tutorial - User Guide, an example app and its reference.

  • Response cache

    @cache for endpoints and functions: one entry for everybody or one per user, invalidation by tag, signed or encrypted entries.

  • Backends

    In memory, Redis, Valkey, GLIDE, memcached or DynamoDB, and a copy in each process in front of them.

  • Pagination

    Seven strategies: page numbers, offsets, ranges, signed cursors, keysets, scrolls and streams, each page cached under its own key.

  • Rate and concurrency limits

    Requests per window and requests at a time, per client or shared, across processes.

  • Idempotency keys

    A retried POST gets the first response instead of running twice.

  • Authentication strategies

    Who makes a request, by strategies: JWTs, bearer tokens, sessions, OAuth2 logins with GitHub or Google, SAML single sign-on, or your own.

  • API keys, tokens and codes

    API keys with scopes and expiry, a blocklist of tokens and one-time codes, nothing stored in clear.

  • Passwords

    Slow hashes with a pepper, leaked passwords refused, guesses limited per account, and resets by a link that works once.

  • Passkeys

    Logins without a password with Touch ID, Windows Hello, a phone or a security key (WebAuthn), which a phishing page can't relay.

  • Second factor

    Authenticator apps' codes (TOTP) after the password, each once, recovery codes, and a recent code for sensitive actions.

  • Authorization

    Who may do what, decided by a Casbin or Cedar policy in the process, or by Open Policy Agent over the network (ACL, RBAC, ABAC), per route or for every request.

  • Sessions, CSRF and security headers

    Sessions you can revoke, requests from other sites refused, the OWASP headers and a body size limit.

  • Accounting

    What each user, API key or tenant uses per period, held to its plan's quotas, with a usage record per charge for billing.

  • Audit trail

    Who did what to which resource, and whether it worked: no secrets, signed and chained.

  • Checking uploads

    The real type from the bytes, the size, image dimensions and safe file names.

  • Object storage

    Signed URLs and upload forms for S3, R2 or MinIO: files go straight from the browser, bounded in size and type.

  • E-mail

    Password resets, codes and receipts over SMTP with TLS, in messages nothing can add a header or a recipient to.

  • Webhooks and outbound calls

    Standard Webhooks signing and verification, and calls out with a deadline, a breaker and SSRF protection.

  • Errors and observability

    RFC 9457 problem details, request IDs, timeouts, health checks, metrics, traces and logs as JSON.

  • Background work

    Scheduled jobs, a task queue, a leader and locks, shared by every process; messages to all of them, and an outbox for those a change announces.

  • Operations

    Circuit breakers, maintenance mode and feature flags that every process sees at once.

  • Security model and resilience

    What gets cached and for whom, what the backend is trusted with, and what happens when it fails.