标签：#API

The Model Comparison Problem Most AI model comparisons are useless for developers making real decisions. They benchmark on academic datasets that don't reflect production workloads. They test frontier capabilities that matter for 5% of use cases. They ignore latency, cost, rate limits, and API reliability — which are the things that actually determine whether a model works in your application. This comparison is different. It's focused on what matters when you're building something: how Grok and Gemini perform on the types of tasks developers actually encounter, what each model's API experience is like, and where the genuine tradeoffs lie. I'm deliberately not including benchmark scores. If you want MMLU numbers, there are plenty of leaderboards for that. This is about production utility. What Each Model Actually Is Grok (xAI) Grok is xAI's model family. The current production models are Grok-3 and Grok-3 Mini, with Grok-3 being the flagship. Grok has a large context window (128K tokens standard, with extended context available), real-time access to X (Twitter) data as a differentiating feature, and strong performance on reasoning-heavy tasks. The xAI API follows a familiar REST pattern and is broadly compatible with OpenAI SDK conventions, which makes migration straightforward. Grok's notable characteristics: Strong at structured reasoning and multi-step problem decomposition Real-time web access via the API (useful for tasks needing current information) Relatively generous rate limits compared to some competitors Less restrictive on certain content categories than some other models Gemini (Google DeepMind) Gemini is Google's model family, currently anchored by Gemini 1.5 Pro and Gemini 2.0 Flash. The defining feature of Gemini is its context window — Gemini 1.5 Pro supports up to 1 million tokens in production, which is genuinely useful for certain document-heavy use cases. Gemini also has the tightest integration with Google's ecosystem (Workspace, Cloud, Search)

If you've been writing Python for more than a year, you know the ritual. A new project. A fresh terminal. And then: pyenv install 3.12.3 pyenv local 3.12.3 python -m venv .venv source .venv/bin/activate pip install pip --upgrade pip install -r requirements.txt Six commands before you've written a single line of code. And that's if nothing breaks. Enter uv a single binary that replaces pip , virtualenv , pip-tools , pyenv , and pipx . Written in Rust. 10–100x faster than pip. And honestly, one of the most pleasant tools I've used in the Python ecosystem in years. Let's dig into it. What Even Is uv ? uv is a Python package and project manager built by Astral , the same team behind ruff , the linter that everyone switched to and never looked back. The goal is simple: be the Cargo for Python . One tool, one lockfile, no friction. It's a standalone binary with zero Python dependencies, which means it works even before Python is installed. Installing uv # macOS / Linux curl -LsSf https://astral.sh/uv/install.sh | sh # Windows (PowerShell) powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex" # Or via pip if you prefer pip install uv Verify: uv --version # uv 0.9.x The Speed Claim Is It Real? Yes. Embarrassingly so. Here's a timed comparison on Apple Silicon (Python 3.14): Operation pip / venv uv Create virtual env ~2 seconds 35 milliseconds Install FastAPI + deps (cold) ~12s ~1.2s Install with warm cache ~8s ~0.1s The warm cache case is where uv really shines it uses a global cache and hard-links packages into environments instead of copying them. If you've installed requests in any previous project, your next project gets it nearly instantly. Starting a New Project This is where uv feels like a completely different world: uv init my-api cd my-api That single command gives you: my-api/ ├── .git/ ├── .venv/ ← already created ├── .python-version ├── pyproject.toml ├── README.md └── main.py No separate python -m venv , no git init , no template c

The CSS ::search-text pseudo-element selects the matching text from your browser's "find in page" feature. ::search-text originally handwritten and published with love on CSS-Tricks . You should really get the newsletter as well.

Most AI tutorials start with a setup checklist. Pick a model provider. Create an account. Wire up a...

“Did We Already Watch This?” — Building KindaSeen with FastAPI and Next.js A few months ago, my friends and I kept running into the same question whenever we talked about movies, dramas, anime, or variety shows: “Did we already watch this before?” Sometimes we remembered the title but forgot whether we had finished it. Other times, we completely forgot we had already seen it at all. That simple problem inspired me to build KindaSeen, a full-stack personal media repository designed to help users track and organize the media they’ve consumed in one centralized platform. The goal of the project was not only to create a useful application, but also to gain hands-on experience building a real-world full-stack system with modern web technologies. What KindaSeen Currently Supports User authentication with Supabase CRUD operations for personal media records TMDB-powered search functionality Watchlist system Favorites system Persistent PostgreSQL storage Dockerized backend deployment Separate frontend/backend deployment workflow Tech Stack Frontend Next.js React Tailwind CSS Shadcn/ui Vercel deployment Backend FastAPI PostgreSQL Docker Render deployment External Services Supabase Authentication TMDB API integration One of the main goals of this project was to simulate a more realistic production workflow by using a decoupled frontend/backend architecture instead of building everything inside a single monolithic application. In this article, I’ll share: Why I chose this architecture How I integrated TMDB into the application Challenges I faced during deployment What I Learned From Building KindaSeen Why I Chose This Architecture Instead of building a monolith using Next.js API routes, I decided to decouple the application into a Next.js frontend and a FastAPI backend. This decision was driven by three main factors: AI Compatibility & Future Proofing : While researching the job market, I noticed that most companies building AI products heavily rely on Python. By choosing FastA

Let me start with a confession: I'm a data scientist who's been burned by hype more times than I care to admit. When everyone told me "Model X is the next GPT-killer," I'd run my own benchmarks and find... well, let's just say the results were rarely as advertised. So when I started seeing claims about Chinese AI models catching up to (and sometimes surpassing) Western counterparts, I did what any self-respecting data nerd would do: I put them through my own rigorous testing pipeline. Over the past three months, I've run over 2,000 API calls across four major Chinese model families — DeepSeek, Qwen, Kimi, and GLM — using Global API's unified endpoint (more on that later). I tracked latency, token costs, output quality across multiple benchmarks, and even threw in some real-world tasks that mattered to me personally. Here's what I found, with all the numbers you'd expect from someone who still gets excited about statistical significance. The Testing Methodology (Because Anecdotes Aren't Data) Before we dive into results, let me be transparent about my approach. I ran each model on the following standardized tests: Code Generation : HumanEval (Python) and MBPP (multi-language) — 164 problems total Reasoning : GSM8K (math word problems) and MMLU-Pro (general knowledge) — 1,200 questions Chinese Language : CLUE benchmarks (text classification, NER, reading comprehension) — 3,500 samples English Language : LAMBADA and Hellaswag — 2,000 samples Speed : Average tokens per second over 100 consecutive requests with consistent prompt lengths I also tested vision tasks where applicable, but let's be real — Kimi doesn't support vision at all, and DeepSeek's implementation is... experimental at best. More on that later. All tests were conducted using the same global-apis.com/v1 endpoint, which normalizes API compatibility to OpenAI's format. This isn't an ad — I genuinely found it made my testing easier because I could swap models without rewriting code. The Big Picture: Pricing

Three Polymarket CLOB gotchas: 401, "invalid signature", and a cancel that does nothing Automating Polymarket with py-clob-client , I lost an embarrassing amount of time to three failures that aren't clearly documented anywhere. Here they are with the exact fixes, so you don't. 1. Your cancel returns 404 — because the endpoint isn't what you'd guess The intuitive DELETE /order/{id} returns 404 and your order silently stays open. The real endpoint is: DELETE /order body: {"orderID": "0x..."} # and the body is part of the signature Sign request_path = "/order" together with that body, then send the exact body. Miss this and your "canceled" orders keep resting on the book. 2. 401 Unauthorized that "should work" Authenticated calls need L2 HMAC headers, and the most common silent mistake is POLY_ADDRESS : it must be your wallet address , not the api_key. The reliable move is to let py-clob-client build the headers via create_level_2_headers from correctly-formed RequestArgs (method, request_path, body, serialized_body) — and make sure the serialized body you sign is byte-for-byte the body you send. 3. invalid signature = SignatureType / funder mismatch Nine times out of ten this is the SignatureType not matching how your wallet holds funds: 0 = EOA funder = your own wallet (holds USDC) 1 = POLY_PROXY funder = the proxy address (email/magic wallet) 2 = POLY_GNOSIS_SAFE funder = the safe address Signing as an EOA while pointing funder at a proxy (or vice-versa) yields invalid signature with no further hint. Bonus: the fill you read is wrong For a BUY , the shares you got are in takingAmount ; for a SELL , they're in makingAmount (takingAmount is the USDC). Read the wrong field and your accounting drifts, which then triggers resubmits and balance errors. I packaged the cancel/auth/fill helpers as a small MIT library: https://github.com/BlueWhale-Quant-Lab/polymarket-401-invalid-signature-cancel-order (For the harder production bits — reading /data/trades for reconciliation

A SaaS team adds “Pay with crypto” to checkout. The first test looks fine: create a wallet address, show a QR code, receive USDT, mark the order as paid. Then production starts. One customer sends the right amount on the wrong network. Another pays after the invoice expires. A third sends 99.80 USDT instead of 100 USDT. Support sees a transaction hash but cannot find the order. Finance sees funds received but cannot match them to an invoice. The backend receives the same webhook twice and unlocks the product twice. That is the moment crypto payment integration stops being a QR-code feature and becomes a payment infrastructure problem. This is the first Dev.to post from Cryptoway . We build crypto payment infrastructure for online businesses, and here we will share practical notes about crypto payment API design, invoices, payment webhooks, stablecoin payments, checkout flows, reconciliation and payment status handling. What is a crypto payment gateway? A crypto payment gateway is the layer between a business event and a blockchain transaction. The business event can be: a SaaS subscription invoice; an e-commerce order; a digital product purchase; a marketplace deposit; a service payment link; an internal billing event. The blockchain transaction is the customer sending BTC, ETH, USDT, USDC or another supported digital asset. The gateway connects the two. It creates a payment request, shows the customer what to pay, monitors the blockchain, updates the payment status and notifies your backend when something changes. In other words: a crypto payment gateway is not the blockchain itself. It is the operational layer that makes blockchain-based payments usable inside real products. Crypto Payment Gateway vs Wallet Address A wallet address is enough for a manual payment. It is not enough for a product that needs order tracking, support visibility and finance reconciliation. Area Wallet address only Crypto payment gateway Order matching Manual matching by amount, address o

Most scraper demos lie by accident. They show the happy path: one URL, one clean page, one neat JSON object. Then the first real user tries a marketplace search page, a login wall, a JavaScript shell, a rate-limited product page, or a site that serves different HTML to every fetch path. The response still comes back as JSON, so everyone relaxes. That is the trap. A JSON response is not the same thing as a useful extraction. The failure mode agents hate AI agents do not just need scraped text. They need to know what happened. Bad extraction output looks like this: { "title" : "Example product" , "price" : "$29.99" , "availability" : "in stock" } That looks fine until you inspect the source and discover the page was a login prompt, a bot challenge, or a thin JavaScript shell. The extractor filled the schema because the schema was requested. Helpful. Like a smoke alarm that hums a little song while the kitchen burns. Better extraction output separates the data from the confidence and the failure class: { "status" : "failed" , "failure_type" : "login_required" , "confidence" : 0.94 , "extracted" : null , "evidence" : { "final_url_type" : "restricted_page" , "visible_content" : "login prompt" , "structured_data_found" : false }, "next_step" : "Use an authorised source, public item URL, feed, API, or sample HTML." } That is less flashy. It is also much more useful. The useful contract is not “scrape anything” “Scrape anything” is usually a warning label wearing lipstick. For agent workflows, the better contract is: Return structured data when the page provides enough evidence. Return a specific honest failure when it does not. Preserve enough metadata for the caller to decide what to do next. Never invent fields just because a prompt asked nicely. This matters for ecommerce, lead enrichment, price monitoring, competitor tracking, procurement, and internal research agents. If the agent cannot tell the difference between “product unavailable”, “page blocked”, “login require

Mike Schroepfer's Gigascale Capital has raised a large fund to back founders building climate-friendly solutions for the world's energy and material shortages.

Large language models (LLMs) understand and generate text from prompts. OpenAI exposes models through the Responses API . The official openai npm package is the practical way to call it from Node.js. This post covers common patterns beyond a single prompt string. Prerequisites OpenAI account Generated API key Enabled billing Node.js version 26 openai package installed ( npm i openai ) For Markdown output: marked , dompurify , and jsdom ( npm i marked dompurify jsdom ) Client setup Create a client with your API key (read from the environment in production). import OpenAI from ' openai ' ; const client = new OpenAI ({ apiKey : process . env . OPENAI_API_KEY }); The same SDK can target other hosts that implement a compatible API by setting baseURL and apiKey : const client = new OpenAI ({ apiKey : process . env . LLM_API_KEY , baseURL : ' https://your-gateway.example/v1 ' , }); Azure OpenAI uses AzureOpenAI instead. Many third-party gateways support Chat Completions only; the examples below use client.responses.* , so confirm your provider supports the Responses API (especially for tools like web search). Basic integration Pass a string as input and read output_text from the response. const response = await client . responses . create ({ model : ' gpt-5.5 ' , input : ' Write a one-sentence bedtime story about a unicorn. ' , }); console . log ( response . output_text ); System prompt Use top-level instructions for stable behavior (tone, format, role). They take precedence over casual wording in the user message. const response = await client . responses . create ({ model : ' gpt-5.5 ' , instructions : ' Reply in one short sentence. Use plain language. ' , input : ' Explain what an LLM is. ' , }); console . log ( response . output_text ); Few-shot prompting Pass prior turns as an input array with user and assistant roles, then the new user message. Keep task rules in instructions . const response = await client . responses . create ({ model : ' gpt-5.5 ' , instructions :

Shopify introduced GraphQL Cardinal, a new execution engine replacing depth-first traversal with breadth-first execution. The redesign improves large-scale GraphQL performance with up to 15x faster field execution, 6x lower GC overhead, and +4s P50 latency gains. It focuses on execution-layer efficiency and batched resolver processing for high-cardinality commerce queries. By Leela Kumili

Strava will charge a flat monthly fee from developers to access its API

A security researcher found that adding a trailing slash to AWS HTTP API paths bypassed Lambda authorizer authentication entirely, enabling unauthenticated wire transfers at a fintech. The root cause is a path normalization mismatch between HTTP API's greedy route matching and its authorization layer. The same vulnerability class appeared in gRPC-Go via CVE-2026-33186. By Steef-Jan Wiggers

Integrations kill product velocity. Every SaaS team knows this. You ship a killer feature, customers love it, then they ask: "Can it sync with Salesforce? What about HubSpot? Zendesk?" Suddenly your roadmap is hostage to building connector after connector. Each one takes 2-3 weeks. Your engineers hate it. Your customers wait. Competitors who solve this faster win deals. The standard response has been iPaaS platforms. They help, but they don't fundamentally change the game. You still need engineers to map fields, handle edge cases, and maintain brittle connections. The real breakthrough isn't just automation , it's making integrations LLM-native from the ground up . What Actually Makes an Integration Layer "AI-Native"? Let's cut through the marketing speak. Every B2B tool now claims to be "AI-powered." Most just added a ChatGPT wrapper to their UI. Real AI-native architecture means three things: 1. LLM-Ready Connectivity via MCP Servers Model Context Protocol (MCP) is Anthropic's standard for connecting LLMs to external data sources. If your integration layer doesn't support MCP servers natively, your AI features will always be bolted on, not built in. MCP servers expose your SaaS data to language models in a structured way. Instead of engineers writing custom API wrappers for every LLM interaction, you get a standardized interface. Claude, GPT-4, and future models can query your integration layer directly. Example: A customer support tool with native MCP integration lets an AI agent pull ticket history from Zendesk, check Stripe subscription status, and update Salesforce records in one conversation flow. No custom code. No brittle middleware. 2. AI-Mapped Data Migration Data migration is where most SaaS deals die. Customer says "we'll switch from ServiceNow to your ITSM if you migrate our 50,000 tickets." Your team estimates 6 weeks. Deal stalls. Traditional migration means: Manual field mapping spreadsheets Custom scripts for data transformation Downtime windows Hi

PostgreSQL LISTEN/NOTIFY for Real-Time Multi-Tenant Events: Ditching Polling and WebSocket Complexity I've shipped real-time features in CitizenApp using three different approaches: naive polling (embarrassing), Redis pub/sub (overkill), and now PostgreSQL's native LISTEN/NOTIFY. The third option is what I should have started with. Most teams reach for Redis or RabbitMQ the moment they need real-time updates. It's the conventional wisdom. But here's the truth: if you're already running PostgreSQL, you have a battle-tested pub/sub system sitting right there. It handles multi-tenancy correctly, scales to thousands of concurrent connections, and eliminates an entire infrastructure dependency—which matters when you're deploying to Render or Vercel where every added service is friction. Why LISTEN/NOTIFY beats the alternatives Polling is dead. HTTP requests every 2-5 seconds for "new notifications"? That's technical debt masquerading as simplicity. It wastes bandwidth, kills your database with unnecessary queries, and users see stale data. Redis is powerful but expensive. Not just in dollars—in operational overhead. You need to manage connection pools, handle failover, monitor memory usage, and keep another service running in production. At CitizenApp's scale (thousands of concurrent tenants), we were paying $50/month for Redis on top of Render just to broadcast notifications that PostgreSQL could handle natively. WebSockets without a broker are a nightmare. If you're running multiple FastAPI workers (and you should be), a WebSocket connection to Worker A doesn't know about events published by Worker B. You need a message broker to fan-out events across processes. Unless you use PostgreSQL LISTEN/NOTIFY, which handles that automatically. PostgreSQL's pub/sub is: Transactional. Notifications only fire after a transaction commits. Tenant-aware. Use channel names like tenant_123_notifications and broadcast only to the right subscribers. Zero extra infrastructure. It's part

Previously, we learned how to send and receive data in Go. Now, we will combine those concepts and build a simple CRUD API. CRUD stands for: C reate R ead U pdate D elete These four operations form the foundation of most backend applications. In this tutorial, we will build a simple task API in Go using only the standar library. By the end, you will understand: how CRUD APIs work how to handle multiple HTTP methods how to store data in memory how to send and receive JSON data how backend APIs manage resources Prerequisites To follow along, you should have: Go installed basic familiarity with Go syntax understanding of the net/http package basic understanding of JSON handling You can confirm if Go is installed by running: go version Step 1 — Create the Project Create a new folder for the project: mkdir go-crud-api cd go-crud-api Now initialize a Go module: go mod init go-crud-api This creates a go.mod file for managing project dependencies. Step 2 — Create the Server File Create a file called main.go . Your project structure should now look like this: go-crud-api/ ├─ go.mod └─ main.go Step 3 — Write the CRUD API Open main.go and add the following code: package main import ( "encoding/json" "net/http" ) type Task struct { ID int `json:"id"` Title string `json:"title"` } var tasks [] Task func tasksHandler ( w http . ResponseWriter , r * http . Request ) { w . Header () . Set ( "Content-Type" , "application/json" ) switch r . Method { case http . MethodGet : json . NewEncoder ( w ) . Encode ( tasks ) case http . MethodPost : var task Task err := json . NewDecoder ( r . Body ) . Decode ( & task ) if err != nil { http . Error ( w , "Invalid JSON" , http . StatusBadRequest ) return } tasks = append ( tasks , task ) json . NewEncoder ( w ) . Encode ( task ) default : http . Error ( w , "Method not allowed" , http . StatusMethodNotAllowed ) } } func main () { http . HandleFunc ( "/tasks" , tasksHandler ) http . ListenAndServe ( ":8080" , nil ) } Now let's unpack what is hap

The row looked perfect. rating: 7 . Valid JSON, right type, no nulls, no missing keys. My schema check waved it through. The page had returned HTTP 200. The selectors hadn't moved. Everything green. A rating of 7 on a 5-star site is impossible. The model invented it, formatted it correctly, and handed it to me with total confidence. That's the failure I want to talk about. Not the scraper that breaks loudly. The one that hands you a clean-looking row that is quietly, plausibly false — and sails past every check you have, because your checks are all looking at the shape of the data, and the lie is in the value . TL;DR HTTP 200, intact selectors, and valid JSON tell you the form is fine. They say nothing about whether the value is true. When an LLM extracts from messy free-text, structured-output mode guarantees you get valid JSON. It does not guarantee the content is real. The model fills uncertain fields rather than leaving them empty — because the schema demands a complete row. A ~60-line value-level sanity gate (ranges, dates, cross-field, reference, language) catches the obvious lies before they hit your database. Real code and real output below. The honest catch: this gate catches rule violations , not plausible lies inside the allowed range . A rating: 4 where the truth is 2 slides right through. I'll be specific about where the gate stops. Two different ways a scraper lies to you I wrote about source drift last week — the case where the page changes underneath you and a 30-line schema check catches the structure shifting. That's an input problem. The source mutated; your agreement with the page broke; you detect it by watching the shape. This is the other end of the pipe. The source is fine. The page is intact, the selectors are correct, the structure is exactly what you expected. The thing that lied to you is the model , on the extraction step, when you asked it to pull structured fields out of a paragraph of human prose. Those two failures feel similar and t

A stack de autenticação em .NET fica sólida quando separamos duas responsabilidades: ✅ Argon2id para guardar senhas (hash irreversível, lento, memória-intensivo) ✅ JWT Bearer para provar identidade depois do login ✅ Validação de iss , aud , exp e assinatura em cada request ✅ Segredos fora do repositório (ambiente / Key Vault) Se o ecossistema .NET já oferece hosting, APIs e pacotes maduros, combinar Argon2 (referência da Password Hashing Competition , testável em argon2.online ) com JWT é o caminho natural para microsserviços e Web APIs. Neste artigo, mostro o fluxo registo → login → token → rotas protegidas com foco no que implementar no dia a dia. ⚠️ Observação importante JWT não substitui Argon2. Nunca coloque senha ou hash no payload do token. Argon2 protege a credencial na base de dados; JWT é sessão assinada com expiração. 🧠 Visão Geral Aspecto Argon2 (senha) JWT (sessão) Foco Resistir a offline cracking Autorizar requests após login Onde vive Coluna password_hash na BD Header Authorization: Bearer Algoritmo Argon2id (OWASP) HMAC-SHA256 ou RSA (config) Ferramenta de estudo argon2.online docs Microsoft JWT Bearer Runtime Biblioteca .NET (ex.: Konscious Argon2) Microsoft.AspNetCore.Authentication.JwtBearer Erro clássico MD5/SHA rápido na senha Token sem validar aud / iss 🧩 O que o Argon2 resolve (camada 1) O Argon2 é o vencedor da Password Hashing Competition — hoje a referência para novas passwords . 1️⃣ Hash irreversível com Argon2id var hash = hasher . Hash ( password ); await store . CreateAsync ( email , hash ); ✅ Salt único por utilizador ✅ Parâmetros m , t , p documentados no próprio hash ✅ Verificação com tempo constante ( FixedTimeEquals ) 2️⃣ Calibrar custo com consciência Em argon2.online podes experimentar memory cost e iterations — útil em laboratório. 📌 Em produção usa biblioteca auditada (.NET), não hashes de utilizadores reais em sites públicos. 3️⃣ O que não fazer na senha ✅ Não “criptografar” senha com AES reversível ✅ Não MD5 / SHA-1 / SHA-256

RecursiveMAS (arXiv 2604.25917) showed that agents sharing internal reasoning state outperform agents that share only final outputs. The average accuracy gain across benchmarks was 8.3 points. The mechanism: each agent passes not just its answer but the latent embeddings from its own reasoning process, and the next agent conditions on both. The paper is a good result. The catch is access. RecursiveMAS requires open-weight models with hidden states exposed at inference time. That rules out Claude, GPT-4o, and Gemini. I built a Claude-native version using the Anthropic extended thinking API. The core idea transfers: instead of passing latent vectors, pass the full thinking text. The paper calls it internal state sharing; the Claude version calls it thinking-block relay. The architecture problem Claude's extended thinking blocks carry an encrypted signature tied to the originating conversation. You cannot pass a signed thinking block into a different agent's messages array. The API rejects it. The workaround: extract the text from the thinking block and inject it as a regular user message. # Extract thinking text from Agent 1 thinking_text = next ( ( b . thinking for b in response . content if b . type == " thinking " ), "" ) # Inject into Agent 2 as regular context, not as a thinking block context = f " Prior agent reasoning: \n { thinking_text } " The signature does not transfer. The reasoning does. relay-structured: what I built first The first architecture was a Planner > Critic > Solver loop where each agent emits a compact mental model JSON instead of raw thinking text. Raw thinking at a 1024-token budget is often compressed and fragmented. The hypothesis was that 150 tokens of structured signal carries more information per token than 1024 tokens of compressed prose. The schema each agent emits: { "interpretation" : "how the agent read the problem" , "key_steps" : [ "step 1" , "step 2" ], "rejected_approaches" : [ "approach tried and discarded" ], "confidence" :