#services

We already showed you how to build a Beautiful REST+JSON API, but how do you secure your API? At Stormpath we spent 18 months researching best practices, implementing them in the Stormpath API, and figuring out what works. Here’s our playbook on how to secure a REST API.

User Management and Authentication for Developers

User Management and Authentication for Developers

Consume and distribute software in the cloud on the largest API hub in the universe.

Consume and distribute software in the cloud on the largest API hub in the universe.

It is a widget that is inserted in your blog and allows you to receive link submissions from your readers

Haraka is an SMTP server which uses a plugin architecture to implement most of its functionality. It uses a highly scalable event model to be able to cope with thousands of concurrent connections. Plugins are written in Javascript using Node.js, and as such perform extremely quickly. The core Haraka framework is capable of processing thousands of messages per second on the right hardware.

Treat our data like it matters. Keep it secure and protect our privacy, of course—but also maintain serious backups and respect our choice to delete any information we’ve contributed. No upload without download. Build in export capabilities from day one. If you close a system, support data rescue. Provide one financial quarter’s notice between announcing the shutdown and destroying any user-contributed content, public or private, and offer data export during this period. And beyond that three months? Make user-contributed content available for media-cost purchase for one year after shutdown.

Treat our data like it matters. Keep it secure and protect our privacy, of course—but also maintain serious backups and respect our choice to delete any information we’ve contributed. No upload without download. Build in export capabilities from day one. If you close a system, support data rescue. Provide one financial quarter’s notice between announcing the shutdown and destroying any user-contributed content, public or private, and offer data export during this period. And beyond that three months? Make user-contributed content available for media-cost purchase for one year after shutdown.

These projects are all very different, but the dynamic is the same. Someone builds a cool, free product, it gets popular, and that popularity attracts a buyer. The new owner shuts the product down and the founders issue a glowing press release about how excited they are about synergies going forward. They are never heard from again. Whether or not this is done in good faith, in practice this kind of 'exit event' is a pump-and-dump scheme. The very popularity that attracts a buyer also makes the project financially unsustainable. The owners cash out, the acquirer gets some good engineers, and the users get screwed.

Publishing for writers who love Markdown and Dropbox

This is what I wish Delicious had done with Twitter. pinboard.in has this built-in, by the way. "This site provides a simple bookmarking service. We follow your twitter feed, and whenever one of your tweets contains URLs, we add them to your delicious.com bookmarks. Optionally, bookmark URLs in @replies to you. We'll even add a delicious tag identifying the sender if you like."

"Editing, mentoring and coaching for writers"

"You use the same Google Merchant account that App Engine debits as the one that accepts donations. This way no bank account is involved. Then you track the money that goes into the account (using the Google Merchant IPN equivalent). Then you look at your usage stats from the App Engine panel and predicate future usage trends. Then calculate the cost per month. Then divide the cash in the account by that and you have how long the service will run. You make this visible on all pages (at the bottom, say) that this service will run for X months, "Pay now to keep it running." You accept any amount, but you are completely clear about what the costs are. And this is all automated."

"In October 2009 I started a project called Notify.io and a month later announced it. I talked about how it will bring notifications to the web. Now that it’s basically alpha complete, I’ll give you a quick walkthrough of what makes it so great."

If you're locked out of Twitter, try checking out this API method with HTTP Basic Auth using your Twitter credentials. It reports on limit, remaining hits to limit, and time until reset. I'm locked out, and it reports my remaining hits at 0 with about a 1/2-hour until counter reset.

"Determine a basic need -> Create a service that satisfies it in the simplest way possible -> Open it up. "

"Track your reading and bookmark on the go"

"Thmbnl is a compact utility for showing thumbnail-style images of pages linked from your website or application."

"I built a tool to easily turn any command line script ... or any AppleScript responding to a certain handler into a full-blown first-class service, complete with name and keyboard shortcut."