skills.rest
citypaul
citypaulCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

bff-design

Decide, size, and shape backend-for-frontend services with aggregation, resilience, and identity rules.

723|93|Updated Nov 14, 2021
Search Tags:#aggregation#Resilience#Microservices#API architecture#backend-for-frontend#BFF#token exchange
One-click install
npx skills add https://github.com/citypaul/.dotfiles --skill bff-design
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: bff-design
Source: https://github.com/citypaul/.dotfiles/tree/main/claude/.claude/skills/bff-design
Command: npx skills add https://github.com/citypaul/.dotfiles --skill bff-design

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Teams struggle to decide whether they need a backend-for-frontend, how many to run, and what each BFF is allowed to own, often ending up with bloated shared APIs, business logic leaking into BFFs, or confused-deputy identity forwarding to upstream services.

Core Features & Use Cases

  • Adoption and Granularity Decisions: Apply explicit adoption signals, the one-experience-one-BFF rule, frontend-team ownership, and honest cost accounting including modular-monolith versus per-service shapes.
  • Aggregation and Resilience Guidance: Fan out in parallel with propagated deadlines, one retry owner per edge, per-section partial-failure contracts, identity-keyed caching, and streaming composition rules.
  • Upstream Identity Mediation: Prevent confused-deputy attacks with per-upstream token exchange (RFC 8693), audience narrowing, sender-constraining tiers, and logout/revocation propagation.
  • Use Case: When a second client type (mobile app) arrives and frontend teams queue behind a general-purpose API team, use this Skill to decide the BFF topology, define degradation contracts, and design token exchange toward upstream services.

Quick Start

Ask the AI to evaluate whether your system needs a BFF, how many, and what each one may own, given your client types and team structure.

Frequently Asked Questions about bff-design

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I decide whether my system needs a backend-for-frontend?▼

Check the adoption signals: a second client type arriving, screens fanning out to many downstream calls, frontend teams queuing behind a general-purpose API team, or a browser app handling sensitive data. A single-interface app making simple similar requests to one backend can skip it unless the security signal fires.

How many BFFs should I run for web and mobile apps?▼

Use one BFF per experience, not per platform: iOS and Android builds of the same app share one BFF, while a genuinely different experience gets its own. Team structure can override this default, since the pattern's value is a team owning its own release pace.

GraphQL federation vs per-client BFFs, which should I choose?▼

They are orthogonal: GraphQL is a protocol choice inside the ownership decision. Federation fits when domain-schema contribution across many teams is the bottleneck and a platform team runs the supergraph; per-experience BFFs fit when experience shaping and team pace are the bottleneck.

How should a BFF forward user identity to upstream services?▼

Never send the BFF's client-credentials token plus an X-User-Id header, which is the confused-deputy anti-pattern. Exchange the session token per upstream for an audience-restricted, down-scoped token via RFC 8693 or OBO, so upstreams authorize on the verified user identity.

What logic is not allowed inside a BFF?▼

Business rules, product authorization decisions, and durable domain state must not live in a BFF; it only shapes, aggregates, and thins payloads for one experience. When decision-shaped logic appears, push it down into a domain service rather than merging BFFs upward.

When is a BFF the wrong choice?▼

Skip it when one interface makes simple similar requests to one backend and no security signal applies, or when you already run a meta-framework server like Next.js or Remix, which already is a BFF. Also avoid adopting N microservice BFFs when a modular-monolith BFF provides the same boundaries cheaper.

Related Skills

Explore More Software Engineering Skills→
paulinghampaulingham
1

bff-scaffold

Generate channel-specific BFF scaffolds with upstream clients, transformers, and middleware.

Community
Advanced
claushaasclaushaas

api-contracts

Define and govern API contracts across service boundaries.

Community
Advanced
geinalageinala

logging-best-practices

Configure middleware to emit standardized JSON wide events per request for unified logging across services.

Official
Advanced
tomtoto757tomtoto757
14

commerce-api-gateway

Aggregate commerce microservices behind a GraphQL federation gateway with rate limiting and unified authentication.

Community
Advanced