Work note 03 of 04
Protocol plumbing, implemented once and versioned
Webhooks and OAuth2 client credentials shared across more than one PayloadCMS application, where the engineering that mattered was the release discipline rather than the code.
- Context
- B2B2C platform, numerous markets worldwide
- My role
- Sole author, written from scratch; published to a private repository and registry
- Status
- All in use, deployed in numerous markets worldwide, used daily.
- Stack
- PayloadCMS
- TypeScript
- OAuth2
- Webhooks
- semver
Two pieces were needed across more than one PayloadCMS application: outbound webhooks able to authenticate with either basic auth or the OAuth2 client credentials flow, and OAuth2 client credentials on the other side, protecting an application’s own REST endpoints.
There is nothing clever in either one. Both are specified protocols, and the work was implementing them correctly — which is the entire value, because the alternative is several slightly different partial implementations, each with its own slightly different bug, discovered at a different time by a different team.
The work that actually mattered
I will say plainly that neither plugin does a great deal. They have also turned out to be among the most useful things I built there, which is usually how boring infrastructure goes.
The part that took real thought was distribution: working out the right way to publish these into a private repository and registry, and treating semantic versioning seriously enough that the applications depending on them could upgrade deliberately rather than by accident. Shared code without release discipline is not a shortcut — it is a way of coupling several applications to each other’s mistakes.
What it generalises to
“Implement the specification correctly, once” is an unglamorous answer that is usually the right one. There is rarely an advantage in a bespoke take on OAuth2.
The decision worth being deliberate about is not the code but the seam. A versioned package with a real release process is what turns shared code from a liability into infrastructure, and that is a judgement about process rather than about programming.