You are opening your product’s API to outside partners. How do you design authentication, authorization, rate limiting and change management for it?

What the interviewer wants to hear

• Use OAuth 2.0 scopes for user-delegated access and hashed API keys for server-to-server use
• Scope every request to the partner’s tenant and permissions
• Apply per-client rate limits and quotas with clear headers
• Sign outgoing webhooks and support key rotation
• Version the API, publish an OpenAPI contract and deprecate with notice
• Log and monitor usage per client for abuse and debugging

Model answer

For partners acting on behalf of our users, I use OAuth 2.0 authorization code flow with narrow scopes like orders:read, so users approve exactly what the partner can do. For server-to-server integrations I issue API keys with a visible prefix, store only their hash, allow several active keys for rotation and let customers revoke them. Every request is scoped to the client’s tenant and scopes in a central authorization layer. Rate limits and quotas are per client, enforced in a shared store, with 429 responses and RateLimit headers. Outgoing webhooks are signed with HMAC and a timestamp to stop replay. The API is described by an OpenAPI contract, versioned, and changed additively; breaking changes get a new version, deprecation headers and months of notice. Per-client logs and dashboards help support partners and spot abuse.

More hard Full Stack Developer questions

• You are building a multi-tenant B2B SaaS app. How would you design data isolation between tenants, and what are the trade-offs?
• Your app works well for 1,000 users. Traffic is expected to grow to 1 million users. How would you prepare the system, and in what order?
• An order flow touches your database, a payment provider and an email service. How do you keep the system consistent when any step can fail?
• You need to split a large users table column "name" into "first_name" and "last_name" on a table with 50 million rows, with no downtime. Walk through your plan.
• For a large e-commerce site in Next.js, how would you choose the rendering and caching strategy for the home page, product pages, cart and account pages?
• Design an e-commerce checkout end to end: cart, payment with a provider like Stripe, inventory and order confirmation. What can go wrong and how do you make it reliable?
• Your startup’s Next.js monolith is growing and some engineers want to split it into microservices. How do you decide, and what would you do?
• Ten minutes after a deploy, 500 errors jump from 0.1% to 8% on the main API. Walk through how you handle the incident.
• Customers need to import CSV files with up to two million rows into your app. Design the feature end to end.