One page to re-read in the final hour. No new learning here — only recall.
HTTP status codes
| Code | Meaning | Say / Do |
|---|---|---|
| 200 / 201 | OK / Created | Success |
| 400 | Bad request | Fix payload shape |
| 401 | Unauthenticated | Check key/token/header |
| 403 | Forbidden | Check scopes |
| 404 | Not found | Check id / URL version |
| 409 | Conflict | Duplicate / version clash |
| 429 | Rate limited | Backoff + jitter, Retry-After |
| 500+ | Server error | Retry, status page, request id |
Auth in 4 lines
| API Key | Static secret header — simple server-to-server |
|---|---|
| JWT | Signed token, expiry + claims — sessions/services |
| OAuth 2.0 | User grants scoped access + refresh token — Google/Slack style |
| HMAC signature | Verify webhooks really came from the provider |
Webhook checklist (recite this)
- Verify signature
- Return 200 FAST
- Dedupe by event id
- Process async via queue
- Idempotent DB writes
- Retry + dead-letter on failure
LLM in 6 lines
- Token ≈ ¾ word. Cost + limits counted in tokens.
- Temperature 0 = extraction/classification. Higher = creative.
- Structured output: JSON schema → validate → retry once → fallback/human.
- RAG: chunk → embed → vector DB → retrieve top-k → answer with citations.
- Hallucination fix: grounding, citations, 'say unknown', human gate.
- Eval: golden set, accuracy / parse-fails / latency / cost. Never ship on vibes.
Prompt skeleton
ROLE + TASK + RULES (never guess, null if missing)
+ OUTPUT FORMAT (exact JSON schema)
+ FEW-SHOT EXAMPLES (2-3)
+ DATA inside delimiters <<< ... >>>Debugging in 5 steps
Reproduce → Isolate (curl/Postman test) → Check auth/payload/limits/status → Fix → Verify + document.
Power phrases
- “Let me structure that…”
- “The trade-off is…”
- “I'd verify that by…”
- “I haven't done X in production, but I've built Y — the approach would be…”
- “First I'd clarify: volume, latency, and accuracy needs?”