Accept vs Content-Type: what they do and how they differ
A clear, practical explanation of the HTTP Accept and Content-Type headers, how they interact, and how this differs from ETag behavior, with examples and a checklist.
Read the guideThe working library
Practical guides for your next working system
Clear answers about automation, APIs, software decisions and reliable publishing. Browse every published Stack & Method article, from the first question to the next useful step.
63 published guides. Browse the latest additions or return to the journal.
Authentication vs authorization in APIs (with request signing)
A clear, practical distinction between API authentication and authorization, focused on how request signing proves who sent the request while separate checks decide what they can do.
Read the guideHow to do cursor-based pagination
A practical guide to implementing API cursor pagination with a next token: picking a stable order, building opaque cursors, HTTP patterns, SQL examples and common pitfalls.
Read the guideHow to use pagination in an SQL query with a cursor?
Practical, source-backed steps to implement cursor (keyset) pagination in SQL: deterministic ordering, indexed columns, next-page WHERE filters, and opaque cursors, with PostgreSQL examples.
Read the guideHTTP API vs REST API: what it means for webhook events that arrive out of order
A clear answer to HTTP API vs REST API and why neither guarantees webhook ordering. Practical patterns to accept, dedupe and reconcile events when deliveries are out of order.
Read the guideIs keyset pagination the same as cursor pagination?
A practical comparison of keyset vs cursor pagination, how they relate, and how to implement a scalable next/previous flow.
Read the guideRequest headers vs response headers in HTTP, using ETag
Request headers come from the client; response headers come from the server. With ETag, the server sends ETag in responses and clients send If-None-Match or If-Match in requests to enable caching and concurrency control.
Read the guideUsing Basic Authentication in an API request
A practical guide to forming the Authorization header for HTTP Basic Auth, when to use it, how it differs from request signing, and safe usage tips.
Read the guideWebhook vs WebSocket: the difference, and how authentication works
A clear comparison of webhooks and WebSockets with practical authentication guidance: headers, message signatures, handshakes, and real-world patterns.
Read the guideWhat is an ETag response header?
A concise, practical explanation of the HTTP ETag response header, how it works with If-None-Match and If-Match, and when to use weak vs strong validators, with clear examples and a setup checklist.
Read the guideDoes a cron expression have 5 or 6 fields?
The short answer and how to tell which format your scheduler expects, with a worked conversion example and a quick checklist.
Read the guideHow to fix 412 Precondition Failed
A practical fix for HTTP 412: confirm the conditional header that failed, fetch the current ETag or Last-Modified, then choose a safe retry or intentional override. Includes 409 vs 412 guidance and a concrete curl example.
Read the guideHow to stringify a JSON object in Python
Use json.dumps(obj) to serialize Python data to a JSON-formatted string; use json.dump(obj, fp) to write JSON directly to a file. Examples include pretty printing, compact output, Unicode handling and safe settings for NaN/Infinity.
Read the guideHTTP 201 Created: when to return it (vs 202)
A practical answer to what HTTP 201 means, how it differs from 202, and how to structure headers and bodies for reliable API clients.
Read the guideWhat do JSON parsers do?
A clear explanation of what JSON parsers do, how they work, how they differ from JSON.stringify, and when to use each, with a worked JavaScript example and a practical checklist.
Read the guideWhat does a 202 HTTP response mean?
A clear answer to HTTP 202 Accepted, how it differs from 201 Created, when to use each, and how clients should handle 202 with a practical example.
Read the guideWhat does HTTP code 304 mean?
A clear, practical explainer of HTTP 304 Not Modified, how it’s triggered with validators, what a 304 contains, and how to test it.
Read the guideWhich HTTP response status code indicates a request was incorrectly formed?
Direct answer with practical guidance: when to use 400 Bad Request instead of 422, and how that differs from 409 Conflict and 412 Precondition Failed.
Read the guideWhich HTTP status code represents no content?
A clear answer to the PAA: 204 No Content. Practical differences from 304 Not Modified, with examples and a quick validation checklist.
Read the guideWhy do we use JSON.stringify?
A concise, practical answer to why teams call JSON.stringify, with clear examples, edge cases, and a pre-ship checklist.
Read the guideBase64 URL encoding explained
What Base64URL is, how it differs from URL percent-encoding, when to use it, and how to implement it safely with practical code and a deployment checklist.
Read the guideConnection timeout vs read timeout: practical guidance for API calls
A clear, practical explanation of connection timeout vs read timeout for API clients, with examples, tuning tips, troubleshooting and a quick checklist.
Read the guideHow to check HTTP response headers in Chrome
Open Chrome DevTools, use the Network panel, and read the Headers tab to see Response headers like Content-Type alongside Request headers like Accept. Learn the exact steps, how to copy headers, and how to avoid confusing Content-Type with Content-Encoding.
Read the guideIs HTTP DELETE idempotent?
A direct answer with practical guidance on retries, status codes, and where idempotency keys do or don’t apply.
Read the guidePreflight vs XHR: what’s the difference?
A clear, practical explanation of how a CORS preflight (OPTIONS) differs from an XMLHttpRequest (XHR), when browsers send preflights, and how that affects your requests.
Read the guideWhat are JSONL files?
A clear explanation of JSON Lines (JSONL), how it differs from standard JSON, safe reading and writing practices, pitfalls, and examples.
Read the guideWhat is an idempotency key in APIs?
A clear definition of API idempotency keys, how they work, when to use them, concrete server and client steps, error semantics, and test scenarios.
Read the guideWhat is the HTTP Accept header?
A clear explainer of the HTTP Accept header, how it differs from Content-Type, and how to use it in real requests.
Read the guideWhat is the point of URL encoding?
A clear explanation of percent-encoding, which characters are affected, when to apply it, and how it differs in purpose from other encodings when placing data in URLs.
Read the guideWhy browsers use CORS, and what a preflight request does
A practical explanation of why browsers use CORS and how a CORS preflight request works, with safe configuration tips and a quick checklist.
Read the guideCorrelation IDs in APIs: what they are and how to use them
A practical explanation of correlation IDs in APIs, with propagation tips, when to use tracing, pitfalls to avoid, and a hands-on checklist.
Read the guideDo environment variables need quotes?
Quotes depend on the shell or .env parser. Compare Bash assignments, Node’s environment-file format and Dotenvx interpolation, then verify a harmless test value.
Read the guideDoes Kafka have a dead-letter queue?
Short, practical answer with patterns: Kafka has no broker-level DLQ. Teams implement a DLQ as a topic, route failed records from consumers or frameworks, and replay safely later.
Read the guideHow long does an OAuth refresh token last?
There’s no universal refresh token lifetime. Providers set their own expirations and revocation rules. See concrete examples (Microsoft defaults, Apigee configuration), rotation behavior, and a checklist to test your app’s handling.
Read the guideHow to refresh an OAuth token
Exchange a refresh_token at the token endpoint, handle rotation and errors, and keep tokens on trusted servers.
Read the guideHow to stop 429 Too Many Requests
Practical steps to stop HTTP 429 errors now: slow down, honor Retry-After, add throttling and safe retries, and know when to contact the provider.
Read the guideHow to test if a webhook is working
A practical workflow to verify webhook delivery and processing using a quick POST, request inspectors, and local forwarding.
Read the guideHow to validate an API
A practical way to validate an API: block bad requests early and assert responses against a contract in tests and CI, with clear error handling.
Read the guideHTTP 409 Conflict: what it means and how to handle it
A concise, practical explanation of HTTP 409 Conflict, how it differs from syntax/validation errors, and a safe re-read and reconcile workflow before retrying.
Read the guideProtect against replay attacks: practical layers for APIs
Clear, actionable ways to block replay attacks in APIs: nonces, timestamps, short-lived tokens, sequence windows and scalable replay caches, plus how to test and tune.
Read the guideTypes of pagination in REST APIs
A concise, practical explanation of page/offset, cursor/keyset (seek), and time-based pagination in REST APIs, with trade-offs, examples, and a decision checklist.
Read the guideWebhook signature verification explained
What webhook signature verification is, how HMAC and HTTP Message Signatures work, and practical steps to validate payloads and stop forged or replayed requests.
Read the guideWhat are OAuth scopes used for?
A clear explanation of what OAuth scopes are used for, how they fit into the flow, and practical steps to design, enforce, and test them.
Read the guideWhat does HTTP 422 mean?
HTTP 422 means the request was syntactically correct but semantically invalid. Use it to report precise validation errors clients can fix.
Read the guideWhat does refresh token rotation mean? A practical guide
A clear explanation of refresh token rotation, why it matters, how reuse detection works, and practical steps to implement it without race conditions.
Read the guideWhat is a dead-letter queue? Practical explanation and setup checklist
A clear definition of dead-letter queues, how they work in common platforms, when to use them, and a practical checklist to set up monitoring and safe replay.
Read the guideWhat is a payload in a REST API?
A clear definition of payload in REST APIs, where it appears in requests and responses, common formats, and practical steps to build and validate one.
Read the guideWhat is an API timeout? Practical guidance for small teams
A clear explanation of API timeouts with practical steps to set, align and test them across clients, gateways and servers.
Read the guideWhat is API versioning? Practical guidance for small teams
A clear explanation of API versioning with common strategies, how to choose one, and a rollout checklist for small engineering teams.
Read the guideWhat the PATCH method is used for
A clear, practical answer to what PATCH does, how it differs from PUT, and how to use it safely for partial updates.
Read the guideIdempotency keys: safe retries without duplicate actions
Understand what an idempotency key protects, reuse it for the same operation and handle timeouts, concurrency and expired keys safely.
Read the guideCan Google Sheets be a CRM? A practical guide for small teams
best CRM for small business spreadsheets: practical guide to using Google Sheets as a lightweight CRM, with design, automation and migration advice.
Read the guideCan I share my Google Password Manager with my team? Practical guidance for small teams
password manager teams sharing explained. Practical guidance on limits, risks and safer alternatives for small teams using Google Password Manager.
Read the guideCan two people share a password manager? Practical steps for two-person teams
password manager teams sharing explained, with practical steps for shared vaults, permissions, per-user 2FA and audit reviews.
Read the guideShould we retry on 500? Practical guidance for workflow teams
workflow automation error handling retries: practical rules for idempotency, backoff with jitter, timeouts and monitoring to retry safely.
Read the guideWhat are the most common failure points in automated workflows? Practical fixes and checks
workflow automation error handling retries explained with practical fixes for auth, rate limits, timeouts, retries, and observability.
Read the guideWhat are the three types of Kanban? Practical guide for small teams
project management kanban vs to do list: learn the three Kanban board types and when each one is the right fit for small teams.
Read the guideDoes Excel have a CRM? A practical guide for small teams
Clear guidance on whether Excel can be the best CRM for small business spreadsheets, with practical build steps, decision checks and small-team templates.
Read the guideWhat are the downsides of using a Kanban board?
Compare project management kanban vs to do list for small teams. Learn the downsides of Kanban, when a to-do list is better, and low-overhead mitigations.
Read the guideIs there a password manager available for Microsoft Teams? A practical guide
password manager teams sharing explained, with practical workflows and a checklist to secure credential sharing in Microsoft Teams.
Read the guideHow to handle error handling in Power Automate: practical patterns for safe retries
workflow automation error handling retries: deterministic run-after routing, Scope try/catch, Terminate outcomes, tuned retries and Do until guidance for small teams.
Read the guiden8n vs Power Automate: which should you choose?
Compare n8n and Power Automate by integrations, hosting, licensing and governance, then choose a practical first workflow to test.
Read the guideWhat are the differences between REST APIs and webhooks? A practical guide
webhook vs api integration explained for small teams, with standards, security and a practical checklist to choose push or pull.
Read the guide