01
Authentication & Authorization
Centralized identity uses Duende and the OAuth 2.0 / OpenID Connect model. JWT validation protects API access; API scopes describe access boundaries, while authorization checks decide which operations a caller can perform. PKCE protects the authorization-code exchange for public clients.
02
Service Communication
gRPC supports explicit synchronous service contracts where a response is needed in the current operation. Asynchronous messaging serves work that can proceed independently. The choice depends on consistency needs, latency and what should happen when the other service is unavailable.
03
Engineering Challenges
The interesting problems live between boundaries: preserving product and variant identity, keeping seller data decoupled, distinguishing synchronous failure from delayed events, and tracing identity or deployment problems across the request path. Each requires explicit contracts and end-to-end validation.