PPowerduck58m ago · 5 min readMocking Authorization Failures: Expired Tokens, Wrong Scopes, and 403sQuick answer: Most teams mock the 200 and then trust their client's auth handling, yet the auth failures are the responses that actually protect an API and exercise the client's most complex logic: exblogs.powerduck.com
PPowerduck1h ago · 5 min readMocking File Downloads and Binary Responses Without Faking Them BadlyQuick answer: Mocking JSON endpoints is straightforward, but mocking file downloads exposes a different set of assumptions: the response is a binary stream, the headers carry as much of the contract ablogs.powerduck.com
PPowerduck1h ago · 5 min readOAuth Token Refresh in a Client vs a Generated, Spec-Aware FlowQuick answer: OAuth looks solved until a token expires mid-session, and the failure is almost always in how refresh tokens are stored and coordinated rather than in the initial login. A client that keblogs.powerduck.com
PPowerduck1h ago · 5 min readTesting WebSocket and SSE Flows: A Spec vs Collection-Based ToolingQuick answer: Testing a WebSocket by hand in a collection client tells you the server accepts a connection and echoes a message, but it does not give you a repeatable contract for the connection lifecblogs.powerduck.com
PPowerduck1h ago · 5 min readImporting a Postman Collection: What Survives and What Gets Silently DroppedQuick answer: Importing a Postman collection is a useful migration shortcut and a dangerous thing to trust blindly, because the importer faithfully recreates requests while silently dropping or flatteblogs.powerduck.com
PPowerduck1h ago · 5 min readQuery Parameter Serialization: Why explode and deepObject Quietly Break ClientsQuick answer: Query parameters that are arrays or nested objects are one of the most common silent contract mismatches, because the OpenAPI name and type say nothing about how the value is serialized.blogs.powerduck.com
DDaniel Marek5h ago · 13 min readRank Tracking API: What Daily Keyword Positions Really Cost to BuildA rank tracking API either exposes positions that a rank tracker has already collected, or returns search results that your own code turns into positions. Building on a SERP API gives more control, andanmarekdev.hashnode.dev
PPowerduck1h ago · 5 min readThe Snapshot Test That Fails on Every Harmless Timestamp ChangeQuick answer: Snapshot tests are cheap to write and expensive to trust when they lock down an entire response that includes volatile fields like timestamps, generated ids, and request echoes. A snapshblogs.powerduck.com
PPowerduck1h ago · 5 min readMocking Pagination Without Letting Test Data Leak Between PagesQuick answer: Pagination is where mock-based tests quietly get flaky, because most real endpoints don't return a fixed set of rows, and a mock that hands back the same generic page for every cursor leblogs.powerduck.com
PPowerduck2h ago · 5 min readThe 404 Was a Base Path and a Trailing Slash the Client Quietly DroppedQuick answer: A 404 that looks like a missing resource is often a routing problem in disguise: the client dropped a base path prefix, or a trailing slash changed which route the server matched. The reblogs.powerduck.com
