Api

Swipe sideways

1. Dev Tools7 Oct 2026 · #33API Error ExplainerPaste a status code and the response body. Get what broke, what to change in the request, and whether a retry will help.InRequest I sent: POST /api/refunds→OutRetryMedium

   Preview this drop

   1. 0:00 The callPOST /api/refunds returned 401 bad signature twice. The body says the prefix should be sha256=. They may have signed with the example placeholder.
   2. 0:08 What brokeThe server rejected the signature. The status is not a transient outage. The prefix note is a hint about the header format.
   3. 0:16 The changeSign the raw body with the real secret, prefix the header with sha256=, and keep the same idempotency key so a later success does not double-apply.
   4. 0:24 RetryDo not retry the same bytes. Retry once after the header changes. Forging a signature for someone else's API is out of scope.

   No daily video for this drop yet. The in and out lines above are the preview.

2. Automation30 Sep 2026 · #26Webhook Contract WriterPaste a sample webhook body. Get required fields, the idempotency key, retry behavior, and how you will verify the signature.InSample POST body from the form vendor, sent to us:→OutThe checkAdvanced

   Preview this drop

   1. 0:00 The sampleevt_1844, type refund.requested, order 1844, amount 40. Signature header documented as HMAC-SHA256 of the raw body. Retries for 24 hours.
   2. 0:08 Requiredid, type, data.order_id, data.amount, data.currency. created is optional for the side effect.
   3. 0:16 IdempotencyStore evt_1844. A second delivery with the same id returns 200 and does not refund again.
   4. 0:24 The checkCompute HMAC-SHA256 over the raw body with the stored secret and compare to X-Signature. Mismatch is 401 and no side effect. No bypass is described.

   No daily video for this drop yet. The in and out lines above are the preview.