API Developer Weekly
June 25, 2026 - Issue #577
|
|
In this edition, we look at tips for managing multiple APIs in your portfolio, tips from Mark Nottingham on defining well-known URIs, and enterprise-level OAuth for MCP servers. Plus, the HTTP QUERY method is now official, allowing you to gain the advantages of cache controls with a GET while supporting request payloads for complex queries. We look at a new IETF proposal on HTTP Budget-Required status code 427, some insights into how MCP is being used today, and some common API vulnerabilities. Finally, we look at MCP vs. CLI, systems complexity, and SoundCloud's API onboarding as a case study.
-- Happy Reading!
Featured Articles
6 Tips For Managing Multiple APIs
Learn six practical tips for managing multiple APIs, from API registries and governance to monitoring, gateways, and lifecycle planning. by J Simpson [nordicapis.com]
So You Want To Define a Well-Known URI
When to reach for a well-known URI - and the traps that catch most protocol designers. by Mark Nottingham [mnot.net]
Enterprise-Managed Authorization: Zero-touch OAuth for MCP
The Enterprise-Managed Authorization extension to the Model Context Protocol is now stable, enabling organizations to centrally provision MCP server access through their identity provider so users get connected servers on first login without per-app OAuth. by Paul Carleton (Core Maintainer) [blog.modelcontextprotocol.io]
The HTTP QUERY Method
This specification defines the QUERY method for HTTP. A QUERY requests that the request target process the enclosed content in a safe and idempotent manner and then respond with the result of that processing. This is similar to POST requests, but QUERY requests can be automatically repeated or restarted without concern for partial state changes. by Julian Reschke [rfc-editor.org]
How to Design Effective MCP Tools
 Learn intent-based patterns that let LLMs execute real work using the backend systems and APIs you already have. Explore why your current REST APIs break down when LLMs try to use them — and the specific design shift that fixes it. Finally, learn more about the patterns and practices that will help your team prepare your APIs for real-world AI use.
Learn more and download the full report.
Protocol 427: An HTTP Budget-Required Status Code with Post-Quantum-Signed Budget Attestations
Internet-deployed software agents are increasingly authorized to spend money, consume metered services, or commit other resources on behalf of human or organizational principals. Existing HTTP authentication and payment patterns conflate two orthogonal concerns: whether the requester holds a credential at all (the "401" axis), and whether the requester has been authorized to spend a specific amount through a specific settlement rail (the "budget" axis). [datatracker.ietf.org]
10 Interesting MCP Statistics
Explore MCP statistics, reports, and benchmarks on usage, growth, security risks, token bloat, and enterprise adoption trends. by Bill Doerrfeld [nordicapis.com]
Don't Let AI Agents Improvise Against Production GraphQL
AI agents should explore your GraphQL schema in development and invoke only reviewed operations in production. Design in an open world, ship in a closed one - using the Cosmo Router MCP Gateway. [wundergraph.com]
The 5 Most Disastrous API Vulnerabilities
Explore five API vulnerabilities that can cause severe data breaches, fraud, infrastructure compromise, and system takeover. by J Simpson [nordicapis.com]
Slack Eliminates SSH in EMR Pipelines, Migrates 700+ Jobs to Rest-Based Architecture
Slack modernized its data platform by replacing SSH based execution in Amazon EMR pipelines with a REST driven orchestration layer called Quarry. The migration covered 700 plus Airflow operators, improving security, reliability, and observability while eliminating direct SSH access across production clusters and enabling a server side job lifecycle model. [infoq.com]
I Didn't Revoke my API Keys Because Claude Called Me An Idiot
I need to confess something. A few days ago whilst vibe coding at 2am, I accidentally pasted my API key directly into a Claude chat instead of the... by Javvad Malik [blog.knowbe4.com]
Malicious JetBrains Plugins Steal AI API Keys as Chrome Extensions Capture Chatbot Chats
Researchers found 15 malicious JetBrains plugins posing as AI coding tools that exfiltrate OpenAI, DeepSeek, and SiliconFlow API keys. [thehackernews.com]
Business of APIs
The Future of SaaS Is APIs Plus AI Agents
AI agents are changing how users consume SaaS, making robust APIs essential for data access, workflows, and automation. by Art Anthony [nordicapis.com]
SoundCloud Shows What Programmatic API Onboarding Should Look Like
I keep coming back to the problem of scaling the onboarding, the setting up of applications, and the obtaining of API keys across many different APIs. The di... [apievangelist.com]
(Un)Related
The battle for context: why MCP vs. CLI is the wrong fight
The battle for context: why MCP vs. CLI is the wrong fight First post in a while! Buckle up for a social media discourse rabbithole, plus my "Roman Empire" obsession of late. I've been working ... by Kenneth Sinder [ksinder.medium.com]
N-Tier Services and Systems Complexity - Steve Yegge
N-Tier Services and Systems Complexity [yegge.ai]
|
|
Have something to share?
As always, if you want to chat, share a link, or make a suggestion, feel free to drop us a quick note or tagging us on X/Twitter (@launchany and @caseysoftware) or by emailing us at: [email protected].
|
|
|
|
|
