Product4 min read
A free tier is not a trial
A trial that expires is a deadline. A free tier that never expires lets you prototype on your own schedule and upgrade when traffic justifies it.
Blog
Platform updates and engineering notes from the team building Zephiel. 34 posts, published since 2015.
2026
4 postsEngineering7 min read
One error envelope across every provider
Normalising upstream failures is unglamorous work. It is also the single thing developers thank us for most.
Engineering9 min read
Rate limiting without punishing bursty clients
Sliding windows, token buckets, and why we settled on a hybrid that absorbs a 10x burst without letting a runaway loop drain your quota.
Engineering6 min read
Why we publish our p99, not our p50
Median latency is a marketing number. The tail is what pages your on-call. Here is every percentile we measure and how we collect it.
2025
2 postsProduct8 min read
Multistore: one integration, every storefront
Three years after per-store billing, the API it was built for is our fastest growing listing. What we learned building for retailers.
Company7 min read
Ten years
From four providers and a gateway that mostly worked, to here. The things that turned out to matter were not the things we expected.
2024
3 postsCompany7 min read
Nine years of uptime reports and what they taught us about honesty
We have published every bad month since 2015. The commercial damage we feared has not once materialised.
Engineering8 min read
Postgres is still the answer
Nine years, four serious proposals to move part of the workload elsewhere, and one that we actually went through with.
Engineering9 min read
We rewrote the gateway and nobody noticed
Fourteen months, no maintenance window, no breaking change, and one incident that lasted ninety seconds. The strategy was refusing to do it all at once.
2023
2 postsEngineering7 min read
Rate limits in an era of retries-by-default
Every modern HTTP client retries automatically. Several of them retry badly, and the result looks exactly like an attack.
Product8 min read
Every provider suddenly wants to sell you a model
Two thirds of provider conversations this quarter involved a language model. Most of them should not have. Here is how we are deciding what to list.
2022
3 postsCompany6 min read
The support ticket is part of the product
We measure providers on how fast a human answers a technical question. It predicts more about the integration than latency does.
Engineering7 min read
HTTP/3 is an RFC now
RFC 9114 landed in June. QUIC fixes the head-of-line blocking that HTTP/2 pushed down a layer rather than solving.
Product7 min read
Per-store billing, and the customers who asked for it
Multi-storefront retailers kept asking for something our pricing model could not express. So we changed the model.
2021
2 postsSecurity7 min read
What Log4Shell week looked like from the gateway
We are not a Java shop, which turned out to be almost irrelevant. Ten days of dependency archaeology and what we changed afterwards.
Engineering9 min read
Webhooks are a distributed systems problem
Delivery is the easy part. Ordering, duplicates, and the customer endpoint that is down for six hours are the actual work.
2020
3 postsProduct6 min read
Five years of free tiers
We have never put an expiry on a free tier. Here is what that actually costs us and why the number is smaller than people assume.
Engineering8 min read
Idempotency keys, and why we made them mandatory
Every write endpoint now requires one. It is a small imposition that eliminates an entire category of support ticket.
Engineering7 min read
Traffic patterns in a month nobody planned for
March rearranged our traffic. What broke was not capacity — it was every assumption we had encoded about when load arrives.
2019
3 postsEngineering5 min read
Deprecating TLS 1.0 and 1.1
Every major browser drops them next year. We are following, with a twelve-month notice period and a list of exactly who is affected.
Engineering8 min read
Latency budgets for teams without an SRE
You do not need error budgets and a reliability org to reason about latency. You need to know what you are spending and where.
Engineering7 min read
API keys that retire themselves
The average key in our system had not been rotated since it was created. We made rotation the default rather than a chore.
2018
3 postsCompany8 min read
Three years in: the things we got wrong
An honest list. The normalisation layer, the pricing page, the region, and the year we spent building for a customer who did not exist.
Engineering6 min read
TLS 1.3 is finished, and we have already shipped it
RFC 8446 was published this month after four years and twenty-eight drafts. One round trip instead of two, and a much shorter list of things that can go wrong.
Compliance7 min read
What changed for your account on 25 May
GDPR enforcement begins this Friday. Everything we committed to last year has shipped. Here is the short version of what you now have.
2017
3 postsEngineering6 min read
Status pages should show the bad days
A wall of green squares is a marketing asset, not a status page. We rebuilt ours to make degradation visible.
Compliance9 min read
We read the GDPR so you do not have to
Enforcement starts in May 2018. Here is what it actually requires of an API platform, and the four things we are changing now.
Engineering8 min read
Moving the gateway to HTTP/2
Multiplexing removed a class of head-of-line blocking we had been working around for two years. It also broke our connection pooling assumptions.
2016
3 postsEngineering7 min read
What a year in one region taught us
We ran the whole platform from a single region on purpose. Here is what broke, what did not, and why we are finally moving.
Product6 min read
The case against per-endpoint pricing
Charging differently for each endpoint makes your bill unpredictable and quietly teaches developers to write worse code.
Engineering5 min read
Certificates cost nothing now, so everything is HTTPS
Let's Encrypt left beta last month. We have moved every endpoint, including the ones nobody would have bothered with before.
2015
3 postsCompany6 min read
What we learned signing our first ten providers
The good ones had documentation you could read without logging in. That correlation held better than anything else we measured.
Engineering7 min read
Why we are building on REST, for now
Boring, ubiquitous, and debuggable with tools every developer already has. The alternatives are more interesting and that is the problem.
Company5 min read
Six vendors, six invoices, one very tired developer
We counted what it actually cost to add a sixth API to a product last year. The integration was the cheap part.