Production APIs & Architecture

REST and gRPC APIs with Gin and Fiber, PostgreSQL and SQLite, Docker and Google Cloud, Clean/Hexagonal Architecture, and Domain-Driven Design.

1. API Fundamentals: REST, HTTP, and the WebWelcome to Part APIs . This section builds production-ready HTTP APIs and backends in Go — from net/http fundamentals through frameworks, databases, Docker, clo…
2. Designing Clean URLs, Query Params, and RoutingWelcome to the art of designing clean and intuitive URLs. Think of URLs as the street addresses of the web: they guide users and programs to the right destinati…
3. JSON, XML, and Data SerializationEvery API eventually boils down to one question: how do we turn a Go struct into bytes on the wire, and back again? That process is serialization, and Go's stan…
4. Building RESTful APIs with net/httpGo's standard library is unusually capable for building production APIs without a framework. This chapter puts everything from the previous two chapters togethe…
5. Building APIs with Ginnet/http gets you far, but as an API grows — dozens of routes, shared middleware, request binding and validation on every endpoint — the boilerplate adds up. Gi…
6. Building APIs with FiberFiber ( github.com/gofiber/fiber/v2 ) is a Go web framework inspired by Express.js, built on top of fasthttp rather than the standard library's net/http . That…
7. Serving HTML, Templates, and Static FilesNot every Go server is a pure JSON API. Sometimes you need to render an actual web page — a dashboard, an admin panel, an email preview — and serve the CSS, ima…
8. Adding WebSockets to Your APIREST is built around request-response: the client always speaks first. Some features — chat, live dashboards, multiplayer state, collaborative editing — need th…
9. Notifications, SSE, and Real-Time UpdatesNot every real-time feature needs a full duplex WebSocket connection. Notification feeds, live scoreboards, progress bars, and status updates are all one-direct…
10. API Security: Tokens, Auth, and Best PracticesAn API without authentication is an API anyone can call — including people you didn't intend to let in. This chapter covers the common authentication schemes yo…
11. Rate Limiting, CORS, and API GatewaysAuthentication answers who can call your API. This chapter covers three separate but related concerns that shape how much they can call it, from where, and — as…
12. API Documentation and OpenAPI/SwaggerA REST endpoint is only as useful as its documentation. OpenAPI (formerly known as Swagger) is the industry-standard, machine-readable format for describing an…
13. Testing and Mocking APIsAn API without tests is a promise you can't verify. Go's standard library makes HTTP handler testing unusually pleasant: net/http/httptest lets you exercise a h…
14. Versioning, Deprecation, and MaintenanceOnce an API has real clients, it can't just change shape overnight — every field renamed or endpoint removed is a broken integration somewhere. Versioning is ho…
15. Prebuilt Solutions and API BoilerplatesEvery chapter so far has built things from small pieces — a mux, a middleware chain, a JWT check — on purpose, so the mechanics are visible. In real projects, y…
16. API Performance, Monitoring, and ObservabilityAn API running in production without visibility into its own behavior is a black box — you find out something's wrong when a user complains, not when it starts…
17. Deploying and Scaling Go APIsEverything up to this point has run on a developer's laptop. This chapter covers what changes when a Go API needs to run reliably, at scale, in production: buil…
18. Advanced API Rate Limiting and Anti-AbuseThe rate limiting in an earlier chapter used an in-memory rate.Limiter per client — good enough for a single instance, but it breaks down the moment you run mor…
19. Advanced API Gateway and Service MeshOnce an API stops being "one server answering requests" and becomes a dozen services calling each other, two new problems show up. First, clients need a single,…
20. APIs for Graph Databases and NoSQLNot every API sits in front of a relational database. Once your data looks like a network of relationships (who follows whom, which products were bought togethe…
21. APIs for Background Jobs and Task QueuesSome work is too slow to do inside an HTTP request. Sending a confirmation email, generating a PDF invoice, resizing an uploaded image, or calling a flaky third…
22. APIs for File Uploads, Media, and StreamingJSON payloads are small and fit comfortably in memory. Files don't. A profile picture is a few hundred kilobytes; a video upload can be gigabytes. An API that t…
23. APIs for Webhooks and Event-Driven DesignMost of this book so far has been about APIs where the client asks and the server answers. A webhook flips that around: the server calls the client, unprompted,…
24. APIs for OAuth2, SSO, SAML, OpenID Connect"Sign in with Google" buttons, corporate single sign-on portals, and API access tokens all rest on a small set of standards that are frequently confused with ea…
25. APIs for Multi-Tenancy and SaaSA multi-tenant API serves many independent customers ("tenants") from the same running application and, usually, the same database — a project management tool w…
26. APIs for Internationalization (i18n) and Localization (l10n)Internationalization (i18n — eighteen letters between the "i" and the "n") is the work of designing your API so it can support multiple languages, currencies, a…
27. APIs for Feature Flags and Dynamic ConfigEvery deploy used to mean "this code is now live for everyone." Feature flags decouple those two things: the code can be deployed dark, and turned on for 1% of…
28. APIs for Load and Stress TestingUnit tests tell you your API behaves correctly for one request at a time. They tell you nothing about what happens when a thousand requests arrive per second, o…
29. APIs for CI/CD and DevOpsContinuous integration and deployment pipelines are themselves driven by APIs — GitHub Actions, GitLab CI, and every cloud provider's deployment service expose…
30. APIs for Serverless and FaaSEverything so far in this book has assumed a long-running process: a Go binary that starts, listens on a port, and handles requests until it's stopped. Function…
31. APIs for Edge Computing and CDNA traditional API runs in one region (or a handful) and every client, no matter where they are in the world, pays the network latency of reaching it. Edge compu…
32. APIs for Advanced SecurityBasic API security — hashing passwords, checking a bearer token — gets you through the first year of a project. This chapter covers what shows up once an API ha…
33. APIs for Advanced Observability: Metrics and LoggingAn earlier chapter in this book covered basic performance monitoring — enough to notice that something is slow. This chapter is about instrumenting an API prope…
34. APIs for Advanced Observability: Distributed TracingThe previous chapter instrumented a single service well: structured logs, metrics, health checks. But a request to a modern API rarely stays inside one service…
35. RPC and gRPC for APIsSo far, almost every API in this part of the book has spoken the same dialect: resources, HTTP verbs, and JSON. That dialect is REST, and it earns its popularit…
36. Working with SQL Databases: PostgreSQLEvery API in this book so far has kept its data in memory or behind an external service. Real APIs need real, durable storage, and for most backend services tha…
37. Working with SQLite in GoThe previous chapter treated PostgreSQL as the default choice for a Go API's storage. It is a good default, but it is not the only reasonable one. SQLite -- an…
38. Containerizing Go APIs with DockerEvery API built so far in this book runs however you happen to launch it: go run main.go on your laptop, or a binary copied onto a server by hand. That works un…
39. Clean Architecture for Go APIsEvery chapter so far has built one slice of an API — routing, auth, rate limiting, observability. This chapter and the three that follow it step back and ask a…
40. Hexagonal Architecture (Ports and Adapters) for Go APIsChapter 6.39 drew Clean Architecture as concentric rings and established the rule that matters: dependencies point inward, and domain logic never imports a fram…
41. Domain-Driven Design in GoChapters 6.39 and 6.40 answered "which package can import which." This chapter answers a different question: once your domain logic lives in its own package, pr…
42. Building a Complete Project End-to-EndThe last three chapters built the order-management example in pieces: the package layout and dependency direction (Chapter 6.39), the ports-and-adapters vocabul…
43. Deploying to Google CloudChapter 6.38 covered building a Go API into a small, distroless container image with a multi-stage Dockerfile, and Chapter 6.17 covered the general shape of run…
44. Orchestration, Replicas, and Graceful ShutdownChapter 6.17 introduced running multiple replicas behind a load balancer and sketched a first graceful shutdown using signal.NotifyContext and http.Server.Shutd…
45. Thinking Like an Attacker: API SecurityChapter 6.10 built authentication and Chapter 6.11 added rate limiting at the traffic level — both defensive, both essential, and both easy to trust a little to…
46. Caching and Redis for Go APIsEvery database chapter so far assumed each request earns its own round trip to PostgreSQL or SQLite. For a lot of endpoints that's perfectly fine—but some queri…