Codify SaaS Blog - Page 10
Code-first guides and deep dives on building B2B SaaS products, designing APIs, scaling web apps, and modernizing legacy software.
SaaS Webhook System — How to Build Outgoing Webhooks for Your Platform
We built our first webhook system in a weekend. It worked — until a client's endpoint went down and we kept hammering it, queueing failed deliveries in memory until the process ran out and restarted. Here is the production-grade outgoing webhook system we use now.
How to Structure a SaaS Monorepo With NestJS Backend and Next.js Frontend
We spent six months jumping between repos on our first SaaS project. Here is the monorepo structure we use now — Turborepo, shared types, Zod validation, and a CI pipeline that only rebuilds what changed.
SaaS Feature Flags — Building a Simple Feature Toggle System Without Third-Party Services
You do not need LaunchDarkly to ship feature flags. Here is how to build your own toggle system in a day — NestJS backend, Redis caching, Next.js frontend, admin UI, and zero monthly bills.
Database Migration Strategy for SaaS — Zero-Downtime Migrations in Production
The migration was one line. It locked a production table for 45 minutes in the middle of the workday while we watched the error rate climb. Here is how to run database migrations on SaaS without taking the site down.
Next.js App Router vs Pages Router — We Rebuilt the Same SaaS Feature in Both
We rebuilt a data-heavy SaaS dashboard in both Next.js App Router and Pages Router with the same feature set. Here are the performance numbers, auth patterns, and the migration traps that caught us along the way.
How to Build Role-Based Permissions for SaaS Beyond Simple Admin and User Roles
The admin/user role split works until your first enterprise customer asks for workspace-level roles, resource-level permissions, and a role hierarchy that does not require a database migration. Here is the RBAC system we built instead.
OWASP Top 10 for SaaS APIs — How We Audit Our Own Code
We run a security audit before every client launch. Here is the exact checklist we use — the eight OWASP Top 10 vulnerabilities that matter most for SaaS APIs, with NestJS code-level fixes for each one.
OAuth2 Social Login in NestJS — Google, GitHub, and LinkedIn With Passport.js
Setting up one OAuth provider is copy-paste work. Setting up three — Google, GitHub, LinkedIn — with account linking and token lifecycle management is where the real engineering starts. Here is the exact implementation we use.
JWT Authentication in NestJS With Refresh Tokens — Production Implementation
I shipped a single-token JWT auth system once. It worked until I realized that if the token was stolen, I had zero options — no revoke, no rotate, just watch and wait for the 24-hour expiry. Here is how to do it right in NestJS.
NestJS Rate Limiting — 4 Production Strategies With Full Implementation Code
We did not have rate limiting on our first public API. We learned why that was a mistake when a client's integration loop sent 50,000 requests in 12 minutes and the database fell over. Here are the 4 strategies that fixed it.
How to Implement API Key Authentication in NestJS for Your SaaS
JWT auth works for your own users. API key auth works for everyone else's servers. Here is how we built a production-grade API key system in NestJS — generation, hashing, scopes, rotation, rate limiting, and a management UI.
Event-Driven Architecture in NestJS — When to Use It and Full Implementation
Event-driven architecture sounds fancy, but most developers overcomplicate it. Here is what event-driven means (and does not mean) in a NestJS SaaS, with full code you can use today.