Key Takeaways

  • Resend scaled to three million users and 100,000 paying customers by sweating micro-interactions, but autonomous agents ignore the design details human developers love.
  • Rate-limiting headers must follow official RFC standards with three distinct fields: count, unit of time, and retry delay. Bespoke headers prevent automated agent retries.
  • Automated tooling fails to find API schemas unless you publish raw OpenAPI JSON specifications directly under your domain's /.well-known/ directory.
  • Simple binary API permissions like full access or sending-only expose too much risk to autonomous software; agents require strictly isolated, granular token scopes.

Keyboard Shortcuts Mean Nothing to Software Agents

For a decade, winning developer tools meant winning taste. You polished the onboarding flow, reduced latency to double-digit milliseconds, and added slick transitions. Rocha spent months obsessing over these exact human touches while building Resend.

“Well, agents couldn't care less if your icon is animated or not,” Rocha noted. “I remember going on this huge project internally at Resend where every form that we had needed to have a keyboard shortcut.”

Human engineers love keyboard shortcuts. They post screen recordings of smooth command palettes on Twitter. But an autonomous AI agent does not look at your dashboard. It never presses Command-K. It makes raw HTTP calls against your API endpoints. When you spend engineering cycles tuning CSS transitions instead of documenting machine-readable interfaces, you make your product invisible to the next wave of software buyers.

Standard RFC Headers Run Auto-Retries

Most API teams invent custom response headers when they implement rate limits. You have probably shipped headers like X-RateLimit-Remaining or custom JSON error payloads yourself. When a human engineer hits that limit, they read your documentation, spot the error code, and write an exponential backoff loop by hand.

Agents cannot do that reliably. When an agent hits an unfamiliar error shape, it halts execution or burns tokens trying to hallucinate what went wrong. Web standards solved this problem years ago, yet most teams ignore the specs.

“Well, there's actually an RFC for rate limiting with three different headers: one for the count, one for the unit of time, and then one for when you should try again,” Rocha said. “You should follow that RFC, because if you follow that RFC, agents will know, they will know how to auto-retry.”

Adhering to existing protocols removes the friction. As Rocha put it: “The primitives, oh my gosh, that's the only thing that matters, like getting them as standardized as possible.”

Discovery and Permissions Require Machine Primitives

If you want agents to call your product, you have to help them find your endpoints and constrain what they can break. Resend discovered that publishing docs on a web page is not enough. Agents need structured OpenAPI files placed where web crawlers already look.

Rocha set up automated workflows to make this discovery immediate: “how do I make sure that every time we have an OpenAPI spec update, we actually go to our website, and trigger a CI job to update and add to the .well-known folder.”

Security patterns also require a total inversion. To make onboarding quick for humans, Resend initially offered two basic permission tiers. “We wanted to make auth as easy as possible, so the permissions and the roles you'd give in the product, we just made it full access or sending only, as simple as possible. You can start your API key with only that,” Rocha said. “Guess what? Agents want things to be as granular as possible.”

When a human creates an API key for a quick script, broad permissions feel convenient. When an autonomous agent runs with an API key, broad permissions create a security disaster. If the agent gets prompt-injected or misinterprets an instruction, it can wipe your entire account. Machine consumers need narrowly scoped tokens that permit one specific operation and nothing else.

What to Do With This

Open your API repository tomorrow and inspect your HTTP 429 response headers. Replace your custom rate-limit headers with the standard IETF RFC headers for limit, remaining, and retry-after. Then, add a step to your deployment pipeline that writes your raw OpenAPI JSON schema directly into your site's /.well-known/ path.