The latest articles on DEV Community by Armando (@hascar). https://dev.to/hascar https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4146069%2Fa224042d-bd56-45f2-b8f5-dc369186f92a.png https://dev.to/hascar en Armando Sun, 27 Sep 2026 22:41:21 +0000 https://dev.to/hascar/how-i-built-an-encrypted-messaging-api-2edp https://dev.to/hascar/how-i-built-an-encrypted-messaging-api-2edp <p>I built Quayat, a privacy-first chat app. Now it has a REST API for developers.</p> <p>The problem: Every messaging API I tried required bot approval (Telegram), business verification (WhatsApp), or didn't encrypt server-side.</p> <p>What I built:</p> <div class="highlight js-code-highlight"> <pre class="highlight plaintext"><code>REST API with API Key auth (SHA-256 hashed) Rate limiting: 100/day free, 5,000/day premium Webhooks with HMAC-SHA256 signatures AES-256 encryption stays server-side </code></pre> </div> <p>Docs and keys: <a href="https://quayat.me/api/docs/" rel="noopener noreferrer">https://quayat.me/api/docs/</a></p> <p>Happy to answer questions about the architecture.</p> api privacy quayat rest