·4 min read
What's next for api-client, and what I'd do differently
The last post in the series — where the package is headed, and an honest look at what I'd change if I were starting it over today.
❯grep -rl "#api-client" ./posts
#api-client
22 posts
·5 min read
Troubleshooting api-client: the bugs I actually hit, told straight
Not a generic FAQ — the specific, confusing failures I ran into using this package myself, and what the actual fix turned out to be each time.
·3 min read
The api-client cheat sheet: every config option and method in one place
A scannable reference for createClient, defineModule, ctx.request, and every config key covered across this series — for when you know what you need and just want the shape.
·5 min read
Testing without mocking fetch by hand, again
The mock client swaps in for your real one with the same method signatures, so your components and tests don't know or care the network isn't real.
·5 min read
Framework guides: Next.js, Vite, edge runtimes, and plain Node
The same client, wired up correctly in four different environments — and the one Next.js mistake that quietly defeats the RPC bridge from the last two posts.
·6 min read
The SSR RPC bridge, part 2: the security model, threat by threat
Deny-by-default is one layer. Here's every other threat the bridge is built to handle — prototype pollution, CSRF, and the line between what it secures and what your code still has to.
·5 min read
The SSR RPC bridge, part 1: your backend URL is in the browser bundle right now
Import your normal API client into a client component and check the Network tab. This is the architecture that stops that from happening.
·4 min read
The TanStack Query integration: no hand-written query keys
Cache invalidation from the pipeline and TanStack Query's own cache used to be two separate systems that didn't know about each other. Here's how the integration package fixes that.
·5 min read
When your types lie: runtime validation and drift detection
Generated types describe what the spec said at generation time. This is what catches the gap between that and what the backend actually returns today.
·5 min read
Codegen: turning your OpenAPI spec into types you actually trust
generate, watch, validate, diff — the four CLI commands that keep your client's types honest against a real, changing backend spec.
·4 min read
Hooks vs events: shaping every request without touching every method
Adding a trace header to every outgoing request shouldn't mean editing forty methods. Hooks and events are the two different tools for two different jobs.
·5 min read
Stop catching generic Errors: typed error classes and safeMode
A network timeout and a 404 are not the same problem and shouldn't be handled with the same catch block. Here's the typed error hierarchy, and when safeMode is worth the tradeoff.
·4 min read
One client, many tenants: doing multi-tenancy without a footgun
How to resolve the right tenant ID per request in a shared SSR client — and why ambient context beats passing tenantId through every function call.
·6 min read
Why your app feels flaky: dedup, retries, timeouts, and the queue
Four small resilience features that, combined, are the difference between an app that shrugs off a bad network and one that falls apart on a train.
·5 min read
Caching without the cross-user data leak
Three cache strategies, why the cache key includes more than the URL, and how to invalidate cleanly after a mutation.
·5 min read
Auth, all four ways — and the OAuth2 refresh race that breaks most apps
Bearer, cookie, API key, OAuth2 — and the one bug almost every hand-rolled auth layer has: four parallel requests triggering four token refreshes at once.
·5 min read
Global, module, per-call: the config system that stops settings drift
One flaky endpoint needs a longer timeout. Here's how to give it one without touching your global config or copy-pasting settings everywhere.
·5 min read
Global, module, per-call: the config system that stops settings drift
One flaky endpoint needs a longer timeout. Here's how to give it one without touching your global config or copy-pasting settings everywhere.
·4 min read
Composing calls and the response envelope you're throwing away
Most methods just return .data and move on. Here's what's actually inside ApiResponse, and how to combine multiple endpoints into one clean method.
·4 min read
Composing calls and the response envelope you're throwing away
Most methods just return .data and move on. Here's what's actually inside ApiResponse, and how to combine multiple endpoints into one clean method.
·11 min read
The three concepts you need before you write a single line of api-client
Before touching config options, understand the client, the modules, and the pipeline — the three ideas everything else in api-client is built on.
·6 min read
I kept rebuilding the same fetch wrapper. So I built api-client instead
Every project I ship ends up with the same auth-retry-cache logic copy-pasted and slightly broken. Here's why I finally turned that pattern into a real package.