
We were running bcrypt on every API request. Cost: 946ms of auth overhead before we did anything useful.
Replaced it with HMAC-SHA256 + an in-memory cache. Auth overhead is now under 10ms. Zero DB queries on the hot path.
The writeup: vesselapi.com/blog/optimizin…
English
