Node.js · TypeScript · Vercel Serverless · JWT · Redis · Prometheus · Joi

Stamped.io API Gateway

Serverless middleware that cut p95 latency 75% and error rate 40%

75%

p95 latency cut (800ms to <200ms)

40%

third-party error rate reduced

99.9%

uptime across ~500 daily requests

Problem

Both storefronts called Stamped.io directly from the browser. That exposed API credentials to the client, gave no control over third-party latency or errors, and meant every page paid the full round-trip cost — p95 latency sat around 800ms, and upstream failures surfaced directly to shoppers.

Approach

Designed a Node.js/TypeScript gateway on Vercel serverless functions as the single path to Stamped.io, moving credentials server-side behind JWT auth and CORS policy.
Validated every inbound request with Joi schemas and applied per-client rate limiting, so malformed or abusive traffic never reaches the upstream API.
Added a circuit breaker with retry/backoff around upstream calls, so Stamped.io outages degrade gracefully instead of cascading into the storefront.
Layered Redis TTL caching over hot read paths, serving repeat lookups without an upstream round-trip.
Exposed Prometheus health and metrics endpoints, tracking p95 latency and error rate per route.

Architecture

+------------------------------+
| Storefront JS (both brands)  |
+---------------+--------------+
                v
+------------------------------+
| Vercel serverless gateway    |
| JWT auth - CORS - Joi        |
| rate limit - circuit breaker |
| retry with backoff           |
+------+----------------+------+
       |                |
       v                v
+------------+   +--------------+
| Redis TTL  |   | Stamped.io   |
| cache      |   | REST API     |
+------------+   +--------------+
       |
       v
+------------------------------+
| Prometheus health + metrics  |
+------------------------------+

Results

p95 latency cut 75% — from 800ms to under 200ms — for loyalty and reviews calls.
40% reduction in Stamped.io API error rate reaching the storefronts.
99.9% uptime sustained across ~500 daily requests, with Prometheus tracking latency and error rate per route.
Credentials moved fully server-side: browsers now hold zero third-party API keys.