API Developer Weekly
Sept 10, 2026 - Issue #582
|
|
We are back after an extended break. This week, we look at the importance of API docs, discuss when to use WebSockets vs. SSE, discover how a working API call may not be a production-ready integration especially when it comes to agents, and take a look at an early draft for revocable API keys. We also learn how to stay ahead with consumer devices and their health applications, and all things MCP. Finally, we have a look at how API testing is evolving with the addition of LLMs, API governance for agentic AI, and ICANN shutting down their API in favor of CSV-based downloads.
-- Happy Reading!
Featured Articles
Your API docs are a second implementation
Reference documentation is a second implementation of your API. You write it once, by hand, and then the system moves. What one reviewer's three corrections turned up, and the tests that now keep the docs honest. [gatiflow.io]
WebSockets vs. SSE should be about ordering and correctness
The discussion around delivering HTML over WebSockets vs. Server-Sent Events (SSE) with Fetch should really be about event ordering and correctness. Let's understand why. [dashbit.co]
A Working API Call Is Not a Production-Ready Integration
Drawing on 96 AI-built API integrations across PayPal, Maxio, and Twilio, this post examines why a working API call is not the same as a production-ready integration. The results reveal gaps in reliability, error handling, resilience, and maintainability—and show how the APIMatic Context Plugin improved the average readiness score from 74 to 97. [apimatic.io]
This Key Will Self-Destruct: An Open Standard for Revocable API Keys
Every leaked credential should be dead, or dying, within sixty seconds of being found. Here's a proposal to make that the default. by Matt Honea, (Etay Maor), (Danelle Au), (Torsten George), (Tod Beardsley), (Sravish Sridhar) [securityweek.com]
Stay ahead of weak consumer device and API security with these tips
Consumer wearables and health applications offer significant benefits for remote patient monitoring and data exchange, but they could introduce security and privacy risks to healthcare networks. [healthcareitnews.com]
Why 'Bring Your Own Agent' Is Key to MCP Infrastructure
Platforms and models change fast. Here's why MCP infrastructure should work with any agent or model you're using, not just the one that's popular today. by Zuplo [zuplo.com]
MCP Went Stateless: What Now?
Learn how stateless MCP improves scalability and changes state management, security, gateways, and MCP server architecture. by Janet Wagner [nordicapis.com]
Attackers Steal METR API Key and Consume AI Credits Worth About $600,000
Attackers stole a METR API key and consumed credits worth about $600,000, while a later campaign failed to access internal data. [thehackernews.com]
Every MCP Server Bakes In the Provider's Motivations
When a provider ships you an MCP server, they are not handing you a neutral window onto their capabilities. They are handing you a set of tools that someone ... [apievangelist.com]
Can MCP Servers Finally Get Their Own OpenAPI?
You shouldn't have to run an MCP server to know what it does. by Bruno Pedro [apichangelog.substack.com]
MCP vs API: The Difference for Developers
MCP vs API explained for developers: runtime tool discovery, JSON-RPC 2.0, and the 2026-07-28 stateless shift. With code, and when to ship one, the other, or both. [jamdesk.com]
How Fuzz Testing for APIs Is Evolving
Andrea Arcuri explains how API fuzz testing is evolving with LLMs, OpenAPI Overlay, and automated security testing. by J Simpson [nordicapis.com]
AI-Assisted API Design
 The traditional API design process today is bottlenecked by limited time and budgets, forcing teams to choose between delivery speed and design quality. This report reveals a game-changing shift: using LLMs as interactive API design coaches.
Learn more and download the full report.
Business of APIs
API governance for agentic AI
Learn why API governance matters for agentic AI success. Discover frameworks, best practices, and proven strategies for enterprise AI integration. [deloitte.com]
ICANN to Shut Down Open Data Platform and API September 1
ICANN will retire its Open Data Platform and API on September 1, shifting datasets to downloadable CSV files and forcing researchers, registries and domain-industry organizations to update automated workflows that rely on programmatic data access. [circleid.com]
How Identity Federation Empowers Partner API Strategy
Learn how B2B identity federation improves partner API security, access control, governance, and identity lifecycle management. by Kristopher Sandoval [nordicapis.com]
(Un)Related
Securing Claude Code: The New Compliance API, Local Visibility, and Identity Governance
Anthropic's Compliance API now exposes Claude Code session transcripts but misses local hooks, configurations, and non-Anthropic model activity. [thehackernews.com]
Effective Patterns for Advanced MCP Usage
The following article originally appeared on PulseMCP's blog and is being republished here with the authors' permission.Most MCP demos feature a single by Adam Jones, Tadas Antanavicius [oreilly.com]
|
|
Have something to share?
As always, if you want to chat, share a link, or make a suggestion, feel free to drop us a quick note or tagging us on X/Twitter (@launchany and @caseysoftware) or by emailing us at: [email protected].
|
|
|
|
|
