Taapti Technologies logo

Engineering Blog

Field notes on backend, AI & modernization

Practical, founder-written guides from the work we actually ship. No fluff, no listicles.

All articles

MCP authorization sequence: the MCP client calls the server with no token, gets a 401 with a WWW-Authenticate header, fetches protected resource metadata to find the authorization server, runs the OAuth 2.1 authorization code flow with PKCE and a resource indicator, receives an audience-bound access token, and calls the MCP server with a Bearer token
11 min read

Securing MCP servers: your server is an OAuth 2.1 resource server

If you followed a Model Context Protocol authentication tutorial written before mid-2025, there is a fair chance you built the wrong thing. The early guidance had your MCP server mint its own tokens and act as its own authorization server. The June 2025 revision of the spec deleted that model, labeled the change breaking, and a lot of the write-ups still circulating never caught up.

Read article
OIDC authorization-code-with-PKCE sequence: browser to app to authorization server, login and consent, code returned, app exchanges the code plus PKCE verifier, authorization server returns an ID token and an access token, app calls the resource server with the access token
17 min read

OAuth 2.1 vs OIDC: which do you actually need?

The most convincing broken login I have run into looked perfect from the outside. Click the button, bounce out to the identity provider, come back with an access token, and the user is in. It passes review. It sails through every demo. What it has actually shipped is a door that opens for anyone holding a valid token, because an access token is not proof of who is standing in front of it.

Read article
Diagram of three teammates' working hours across time zones with the overlapping window highlighted as the best time to meet
7 min read

How to schedule meetings across time zones (without the 5 a.m. calls)

We run a distributed team out of Surat and work with clients from California to Sydney, so "what time is this for everyone?" is a question we answer every single day. Get it wrong and someone takes a call at 5 a.m., resents it, and quietly stops showing up. Get it right and a global team feels like it's in one room.

Read article
Diagram of a RAG query: the query embedding is used only to look up the top-k original text chunks, which are injected as plaintext into the LLM prompt, with a second arrow showing an embedding being inverted back into readable text
10 min read

Embeddings are not anonymization

"We send the vectors to the model, not the raw text, so the sensitive data never leaves." I have heard some version of that in more than one architecture review, and it sounds reasonable. Your documents go into a vector database as long lists of floating-point numbers. The numbers look nothing like the source. So surely the private data is gone.

Read article
Strangler fig pattern diagram showing a routing facade gradually migrating traffic from a legacy Java monolith to new microservices across three phases
10 min read

Legacy Java modernization without the big-bang rewrite

The most expensive sentence in software is "let's just rewrite it." We've watched teams say it about a ten-year-old Java app, budget six months, and surface eighteen months later with a half-finished replacement, a frozen backlog, and users who are furious and still on the old system. The old system, by the way, is still running. It always is.

Read article
Production RAG pipeline architecture showing document ingestion, chunking, embeddings, a vector database, retrieval with reranking, and LLM generation with an evaluation loop
12 min read

RAG implementation: what the demo never shows you

A RAG demo takes an afternoon. You load a PDF, split it every 1,000 characters, drop the chunks into a vector store, wire up an LLM, and ask it a question. It answers. Everyone in the room nods. Ship it, right?

Read article
Spring Boot vs Node.js comparison for microservices covering concurrency model, memory footprint, cold start, throughput, type safety, and best-fit workloads
10 min read

Spring Boot vs Node.js microservices: how we actually choose

A few years back we shipped a horizontally scalable authentication microservice for a US nonprofit scientific standards-setting organization. It runs on Spring Boot and the JVM, and today it serves all their users. Around the same time we built Bar.Stream from scratch, the hospitality automation platform we still run for its bar and restaurant customers, a live, revenue-generating product. Parts of it run on Robomotion.io, with deployed agents sourcing POS data, specifically the bits that talk to a lot of external services at once. Same team, same JVM, yet two very different architectures: one a lean compute-and-security service, the other offloading its integration-heavy work to agents rather than blocking threads on it. That wasn't an accident, and it wasn't religion. It was the workload, and matching the runtime to the workload is the whole reason the Spring Boot versus Node.js question has a real answer.

Read article