Three customer-success calls in one week, same complaint: “We couldn’t get past auth.” The docs said OAuth2. The Postman collection used API keys. The Python example used a third pattern. Each customer spent two days, then asked for a different vendor. Marcus’s churn rate was 41%.
Service API development · REST + GraphQL + integration engineering · UK
API development your customers integrate. without calling support.
We build APIs the way Stripe builds Stripe: one shape, one auth, one error envelope, idempotent everything, SDKs in your customers’ languages — for UK SaaS, fintech, and B2B platforms.
15mmedian time-to-first-call
99.99%idempotent writes
38public APIs shipped
(Why platforms sign)
APIs your customers actually integrate. Thirty-eight shipped. Eleven minutes median time-to-first-call.
An API is a product surface, not an afterthought. We build the customer journey that starts at “curl this and get a 201 in 15 minutes”.
0
<15min
0
The founder this page is for41% churn · “couldn’t get past auth” · 6%
Marcus sold an API. The product was good. The integrations weren’t happening.
The product wasn’t the problem. The API was. He’d treated docs as a sprint someone would do later. He hadn’t shipped an SDK. He had four ways to authenticate, three error formats, and no idempotency.
We rebuilt the API as a product, with the customer journey starting at “curl this and get a 201 in 15 minutes”. Six months later his churn was 6%. This page is for founders who sell APIs and want them used.
API as a product.
Eight things every API we ship has.
The shape your customers expect, because they already integrate Stripe. Open any row.
API keys for server-to-server. OAuth2 for user-context. Pick one as default. Document the other as a path.
Every error returns the same JSON shape: code, message, request_id, docs_url. Predictable.
Every POST, every PUT. Customer can safely retry. Duplicate keys return the original response.
Cursor-based pagination by default. Filter by indexed fields only. Predictable performance.
HMAC-signed payloads. Per-event retry. Dashboard to replay any failed delivery.
Standard X-RateLimit headers. 429 with Retry-After. Customers can be polite citizens.
Auto-generated from OpenAPI. TypeScript, Python, Ruby (or whichever your customers use most). Versioned.
Live code examples. Postman / Bruno collection. “Try it” with sandbox keys. First call in <15 min for any dev.
THE THIRD-PARTY STACK
Eight integrations we wire most
Every one done a dozen ways. The glue your product needs, wired right the first time.
Stripe (payments, billing, tax)
Subscriptions, Connect, invoicing, Tax, Radar, Identity, Issuing. Idempotent end to end.
GoCardless (UK Direct Debit)
One-off + recurring DD. Bacs lifecycle. Failure handling. Custom mandate flows.
Twilio + MessageBird
Two-way SMS, WhatsApp Business, voice IVR. Delivery receipts wired. Compliance pre-checked.
Resend / Postmark
Idempotent sends, DMARC + SPF, deliverability tuning, suppression handling.
Slack + Microsoft Teams
Slack apps, slash commands, modals, Teams bots with adaptive cards.
HubSpot + Salesforce + Pipedrive
CRM read/write with rate-limit handling. Webhook-driven sync. Conflict resolution in code.
Companies House + sanctions lists
UK KYC + AML triage. Open Banking where required. Sanctions screening with audit.
Xero / QuickBooks / Sage
Two-way accounting sync, multi-tenant friendly. Reconciliation built in, not bolted on.
The pain. The day-1 API architecture.
Each one is the difference between an API customers integrate and one they email support about.
- 01
“Three customers in one week. Same complaint: couldn’t get past auth.”
One auth pattern, one quickstart, one example per SDK. API keys as default. Same auth shape across all three SDK languages. Sandbox keys from the dashboard. Eleven-minute median first-call.
- 02
“Our webhook fires sometimes, customers retry, duplicates pile up in their DB.”
Signed payloads, per-event retry, dashboard replay. HMAC-signed bodies. Exponential backoff. Idempotency keys so duplicate deliveries don’t corrupt their data.
- 03
“Our Python and TypeScript SDKs return different field names. Customers confused.”
OpenAPI as source of truth, SDKs auto-generated. One OpenAPI 3.1 spec. Field names identical across languages. Published to npm + PyPI + RubyGems with your namespace.
- 04
“We renamed a field. Three customers’ production broke before they noticed.”
12-month deprecation policy + warning headers. Breaking changes ship in v2, not v1. Deprecation warnings in headers + email to API key owners 90 days before sunset.
- 05
“One customer hammered us with 50,000 calls and brought down everyone.”
Per-key + per-endpoint rate limits, returned in headers. Standard X-RateLimit headers. 429 with Retry-After. Per-key + per-endpoint budgets. Abuse anomaly alerts to Slack.
- 06
“Our docs are accurate but customers still email support for how-do-I questions.”
Live, runnable examples + 5 recipes + errors page. Docs as UX. Quickstart in 5 minutes. Recipes for the top 5 jobs. Mintlify-built. Sandbox keys served from the docs page.
- 07
“A customer says their integration broke and we can’t see what they sent.”
Request log + replay tool per API key. Every customer key has a request log dashboard. You and the customer see the same data. Debug calls in minutes, not days.
- 08
“Engineers shipped temporary endpoints to unblock a customer. Now they’re permanent.”
Documented or doesn’t ship. If an endpoint isn’t in docs, it isn’t in production. CI fails if a new route lands without an OpenAPI entry.
REST, GraphQL, or RPC.
The honest decision. Lead with REST as the public contract unless your customer base asks otherwise.
REST
What third-party devs, Zapier, and long-tail tooling expect. The public contract.
- Public API for third-party devs
- Webhooks + outgoing events
- Long-tail integrations (Zapier, etc)
- SDKs auto-generated from OpenAPI
GraphQL
Excellent for first-party clients on weak connections. Adds friction for third parties.
- Mobile clients with weak connection
- Flexible reads, fewer round-trips
- Internal frontend data layer
- Webhooks need a workaround
tRPC / RPC
When it’s one TypeScript stack and you want end-to-end types with zero ceremony.
- Internal API for your own frontend
- Single TypeScript stack + e2e types
- gRPC for service-to-service
- Not for third-party consumers
The stack we ship every API on.
OpenAPI as the source of truth. Node + Express runtime. The hiring pool that means your next engineer is productive on day one.
T1
What we build every API on
OpenAPI-firstNode.js + ExpressTypeScriptMongoDBPostgreSQLOpenAPI 3.1MintlifyStripeMixpanelSentryBruno / PostmanGitHub ActionsPlaywright
T2
When your API brief calls for it
reach when neededPython (FastAPI)Java (Spring)GoGraphQLtRPCgRPC
T3
The infrastructure for scale
AWS-defaultAWSAWS LambdaAWS API GatewayKubernetes (EKS)DockerRedisApache KafkaAWS EventBridgeSQS / SNSElasticSearchTerraformDatadog
Results
Marcus’s API,
Marcus’s API,
after the rebuild, in numbers
We rebuilt a sprawling V1 as a defensible V2: single auth, idempotent writes, cursor pagination, signed webhooks, OpenAPI generating three SDKs, docs on Mintlify.
Onboarding
4711
Min time-to-first-call
3
SDKs, zero drift
Retention
416%
Churn, two quarters
−68%
Support tickets
Track record
38
APIs shipped since 2019
0
Silent breaking changes
What CTOs actually ask before signing
Pain-first, soft-second.
REST 80% of the time. GraphQL is excellent for first-party clients on weak connections (mobile, IoT) but adds friction for third-party developers, Zapier integrations, and long-tail tooling that expects REST. We can do both behind the same domain, but lead with REST as the public contract unless your customer base explicitly asks for GraphQL.
Yes, assuming the API has an OpenAPI spec we can clean up. We’ll fix the spec in week one (most need it), then generate TypeScript + Python + Ruby (or your customers’ top three). Manually polished where the generator gets it wrong. Published to npm + PyPI + RubyGems with your namespace. Versioned per release.
URL versioning (/v1, /v2) with a 12-month minimum deprecation window. Breaking changes ship in a new version, never in place. Deprecation warnings in response headers + email to API key owners 90 days before sunset. Receipts in the changelog. We’ve never broken a customer integration without their knowing in advance.
Rate limits per-key + per-endpoint. Scoped tokens. IP allowlists for enterprise customers. Anomaly detection on auth attempts. Stripe-style webhook signatures. Full audit log per token. We don’t ship the API without a written threat model for the top 8 abuse patterns, covered in audit week.
30-day walk-away both ways. Milestone billing 25/25/25/25. UK VAT registered, listed on Companies House, shipping since 2019. You’re never more than four weeks at risk of paying for nothing.
Every API development project has two senior engineers paired, not one. Every decision goes into an ADR the same day. Mohit reviews every PR. Two handovers in seven years, both inside 48 hours.
Yes, easily. Node.js + Express is the largest server-side hiring pool in the UK in 2026. London alone has 14,000+ Node engineers on LinkedIn. The OpenAPI-first discipline we ship means any future engineer is productive on day one.
Yes, with 14 days’ notice. Engineers move to other projects. Spend pauses. Resume with 14 days’ notice. No cancellation fee.
In context
The surface you hand over.
api development, in context — the dashboards, flows and components your team actually ships, reviews and maintains.
One paragraph. That’s it.
Tell us what your API does, who’s integrating it, and where the friction is now. Mohit replies inside 24 hours: a clear yes, a clear no, or the one question that decides it.
What happens after the email lands
- < 24h
A personal reply.
Yes, no, or the deciding question. Straight to your inbox.
- Week 1
OpenAPI shape drafted.
Auth, errors, pagination, webhooks, idempotency, versioning. Signed scope.
- Wk 5
First call in 15 min.
Docs, sandbox, SDKs. A developer hits a 201 without emailing support.