Good APIs rarely call attention to themselves. They behave predictably when things go wrong, make sense under pressure, and are clear about their limits.

Start at the boundary

Treat every request as untrusted. Check its shape, put a limit on how expensive it can be, and return errors that let callers recover without exposing implementation details.

const input = CreateSessionSchema.safeParse(await request.json());
if (!input.success) return problem(400, 'Invalid request');

Plan for failure

Timeouts, retries, idempotency keys, and useful status codes belong in the product contract. They make life easier for clients and operators.

Reliability shapes the user experience, even when no one sees the system underneath.