Jason Fill
Founder of ApiTraffic, the API monitoring, performance and security platform for Node.js teams. Writes practical guides on running production Node APIs: logging, latency, reliability and API security, with code you can ship the same day.
W3C Trace Context in Node.js: correlating requests across services with traceparent
Three services, three log streams, one failed order, and nothing to join them on. W3C Trace Context gives every hop the same trace ID. Here is how to propagate traceparent in Node with OpenTelemetry, or in 30 lines without it.
What small Node teams should log in the AI-attack era
Bots are now more than half of web traffic, and 27% of attacks target APIs and identity systems. You don't need a security team to see it, just the right fields on every request. Here's the minimum to capture, five patterns to watch, and when to block.
Deploy markers: tying a latency regression to the release that caused it
p95 doubled, and there were three deploys and a flag flip since yesterday. Deploy markers and a version field on every log line turn "which release did this" into a five-minute query. Here is how to set both up for a Node API.
Node.js large file upload handling without running out of memory
One 2 GB upload should not take your API down with it. Here is how to stream uploads in Express and Fastify, when to use presigned URLs, and which parsers to patch.
Third-party API latency: measuring vendor slowness and failures in Node
The vendor status page is green and your checkout is slow. Here is how to measure third-party API latency and failures from your own Node servers, per dependency, without wrapping fetch.
SSRF in Node.js: the fetch() you didn't mean to make
A customer pastes a webhook URL pointing at your cloud metadata endpoint, and your API fetches it. Learn how SSRF in Node.js happens, why blocklists on URL strings fail, and a tested safeFetch() you can ship today.
Cursor vs offset pagination: an API design that survives big tables and scrapers
Offset pagination was fast at launch; now deep pages hammer the database and one API key is walking every page. Here is when to switch to cursors and how.
API alerting best practices: what to page on for a Node API
A 3am CPU page that meant nothing, then a real outage that paged nobody. Here is the short list of alerts a small Node API team needs, with rules and code to match.
API key security for Node APIs: prefixes, hashing, scopes and rotation
A customer just pushed their API key to a public repo. Can you tell if anyone used it, and could a database leak expose every key? Design API key security in Node properly: prefixes, hashing, scopes and rotation.
Zod validation in Express and Fastify: request bodies, query strings and useful errors
A null where your handler expected an array becomes a 500 and a support ticket. Validate bodies, query strings and params with Zod 4 in Express 5 and Fastify 5, return 400s clients can act on, and stop extra fields at the door.
API log retention and cost: how much request logging a small team needs
Either the logging bill surprises you or the logs are gone when a customer asks about last month. Here is a retention policy a small team can set up in an afternoon.
Node.js event loop lag: the metric that explains "random" slowness
Every endpoint slow at once, database fine, CPU looks idle: that is event loop lag. Here is how to measure it in Node with built-in tools and find the code that blocks.