Case study
TheAuthAPI
Stripe-style API keys and SDK, as its own product: from an untested prototype to a platform other products adopted.
01Problem
- TheAuthAPI was an unused prototype with no tests. My first task was writing them.
- Those tests surfaced a security bug where API keys could leak across projects.
02Constraint
- A client commitment needed multi-tenancy, and the PM wanted a 2-week bolt-on.
- Existing accounts had to keep working with no manual migration.
03Key decisions
Fix the leak and lock the boundary with tests
Fixed the cross-project key leak and covered that boundary with tests so it couldn't come back.
Trade-offTime spent on tests before features, on a product nobody was using yet.
Rebuild the SDK on Stripe's design
Rebuilt the deprecated SDK in TypeScript, modelled on Stripe's SDK design.
Trade-offA rewrite instead of patching the old SDK, which paid off as 40% faster customer integration.
A scoped refactor instead of a bolt-on
Designed a new Organization entity and a migration that auto-linked existing accounts. I made the bolt-on's risks concrete with live code and diagrams; we agreed a scoped 4-week refactor with a week-3 checkpoint, and it shipped in 3 weeks. Every query is scoped to the organisation by default.
Trade-offAsked for more time than the PM wanted, with a checkpoint so the risk was visible early.
04Result
- Grew into full ownership: backend, React dashboard (with a PM and designer), BigQuery usage analytics.
- Another product (100k+ monthly requests) dropped its own key management to adopt it.
- I stayed primary owner long-term, so customer bugs came back to me.
- Lasting change: the PM and I started checking architecture in sprint planning, not mid-build.