API testing guides — test REST and GraphQL APIs, write contract tests, and automate API validation.
API Testing
Webhook handlers are business-critical but rarely tested systematically. This guide shows how to build a complete webhook testing pyramid in CI/CD: unit tests for handler logic, smee.io integration tests, contract tests with JSON Schema, security tests for signature verification, and Toxiproxy for retry behavior. Full pytest and Jest
API Testing
Svix is managed webhook sending infrastructure — it handles delivery, retries, signatures, and consumer dashboards for SaaS applications that need to send webhooks to their customers. This guide covers testing Svix webhook delivery in your app, using Svix's SDK for signature verification, testing consumer endpoints, and when to use
API Testing
Hookdeck is a webhook gateway and event queue that sits between your webhook senders and your application. It gives you a request inspector for debugging payloads, event replay for development, and filtering and transformation as middleware. This guide walks through setting up Hookdeck CLI for local development, using the dashboard
API Testing
Webhooks are notoriously hard to test because they're triggered by external events, delivered asynchronously, and come with failure modes like duplicate delivery, out-of-order events, and retry storms. This guide covers five testing strategies, plus how to test idempotency, retry logic, signature verification, and failure scenarios with Node.js
gRPC
gRPC streaming RPCs are among the most powerful features of the protocol — and among the hardest to test correctly. Unlike unary calls, streams introduce ordering, backpressure, partial failure, and cancellation scenarios that require different testing approaches. This guide covers testing all three streaming types: server streaming, client streaming, and bidirectional
GraphQL
GraphQL persisted queries reduce payload size and improve security by replacing full query strings with short hash identifiers. But they introduce new failure modes — hash mismatches, cache invalidation bugs, and APQ negotiation failures — that require dedicated testing strategies. This guide covers everything you need to test persisted queries and APQ
gRPC
gRPC security testing is often skipped because certificates are annoying to set up in test environments. That's exactly why certificate misconfigurations, expired credentials, and bypass vulnerabilities make it to production. This guide covers practical approaches to testing gRPC TLS and authentication without making your CI pipeline miserable. What
GraphQL
GraphQL error handling is fundamentally different from REST. A 200 response can contain errors. A query can partially succeed — returning some data while failing on other fields. Null propagation can silently wipe out entire subtrees. If you're only testing the happy path, you're missing half the
Shift-Left Testing
Microservices solve organizational problems — independent deployments, team autonomy, technology flexibility. But they create a testing problem: how do you verify that services that evolve independently still work together? Integration test suites require running all services simultaneously. End-to-end tests are slow and brittle. Neither catches API contract breaks early enough. Contract
Email Testing
Resend has quickly become the developer-favorite transactional email API — clean SDK, React Email template support, and a generous free tier. But email is one of the most undertested parts of most applications. Password reset emails that don't send, welcome emails with broken links, and invoice emails with wrong
API Testing
LiveKit is an open-source infrastructure for real-time audio, video, and data — used by teams building video conferencing, live streaming, voice agents, and collaborative applications. Testing LiveKit-powered apps is notoriously tricky: WebRTC is browser-dependent, media streams are asynchronous, and real room behavior requires multiple connected participants. This guide shows you how
Testing
Testing rate limiting is deceptively hard. The implementation often works correctly in isolation but fails under concurrent load, leaks when clients use different keys that should share a limit, or applies the wrong limit tier to authenticated users. Rate limiting testing requires concurrent request generation, careful timing, and validation of