2025 – Present
ShortMesh
Backend Engineer, Interface and Authy APIs
ShortMesh puts a single REST API in front of the Matrix protocol and its bridges, so an application can send and receive messages on platforms like WhatsApp without implementing any of them. A user links their account once by scanning a QR code; after that, text, files, replies, and group messages all go through one endpoint. Authy sits on top of that and delivers one time passcodes over whichever of those platforms the user prefers. I architected and built the Interface API and Authy, and co-architected the Matrix client they sit on.
If you want to reach someone on the app they actually use, you end up integrating each platform separately, holding credentials for each one, and absorbing every breaking change they ship. Matrix and its bridges already solve the protocol half of that. The catch is that pointing a third party integration straight at a Matrix homeserver hands out credentials and infrastructure detail a caller has no business seeing. The other half of the problem is login codes. SMS is expensive and it does not deliver reliably across borders. It is also, very often, the weakest part of the flow it is meant to be protecting.
Interface API
A Go REST service, and the only way into the Matrix side of the stack. It keeps the Matrix credentials, hands callers scoped tokens instead, manages linked devices, and routes messages in both directions. A caller never learns where the homeserver lives, which keeps the protocol layer replaceable and keeps an integration mistake from reaching it.
Device linking
Linking an account streams the platform's QR code to the caller's interface over a WebSocket. The session belongs to the token that opened it, so one integration's devices are invisible to another's.
Matrix client
A headless Go client on the Mautrix SDK does the real protocol work and holds the bridge connections. It sits behind the Interface API and is never addressable from outside.
Authy
An OTP service layered on the Interface API. It generates the code, tracks the session, checks what comes back, and delivers over whichever bridged platform the user picked. A small JavaScript widget handles that choice in the browser, deliberately shaped like a social sign in button so it needs no explaining.
Storage and transport
State lives in SQLite, encrypted at rest with SQLCipher. RabbitMQ moves work between the API and its workers, so when a bridge is slow the backlog sits in a queue instead of on an HTTP connection the caller is still holding open.
Keep the trust boundary in one place
Nothing outside the Interface API holds a Matrix credential or knows the homeserver address. That single rule settled most of the other design questions. If a caller needed to do something, it became an endpoint, and anything that would have meant handing out protocol level access got turned down instead of worked around.
Tie every token to whoever created it
A token belongs to the credential that issued it, and its device list is its own. Linking, sending, and reading webhooks are all checked against that ownership. A leaked token costs one integration its devices, not the whole deployment.
Encrypt at rest without being asked
The database holds Matrix tokens and device state, which between them are enough to impersonate somebody on their own messaging account. SQLCipher is on by default and switching it off takes a deliberate override that warns you. Security you have to know to enable is security most deployments will not have.
Finish the integration, not just the API
An OTP service that stops at the API has done about half the job. The developer is still left to build the platform picker, wire up the polling and handle the verify round trip. Authy ships a widget, a working demo and generated API docs instead. What is left on the caller's side is a script tag and one callback.
An abstraction over other people's platforms only earns its keep if it also hides its own plumbing. The moment a caller needs the homeserver address to get something done, you no longer have an abstraction, you have a convention.
Getting a login code to somebody is a distribution problem well before it is a cryptographic one. Generating the code is trivial. Landing it on a phone in a market where SMS is costly and lossy is the actual work.
Queues between the API and the bridges are what let the API tell the truth about latency. Without them, a bridge having a bad afternoon turns into timeouts on somebody else's server.
ShortMesh runs as a self hostable stack: Interface API, headless Matrix client, Authy, and RabbitMQ, brought up together under Docker Compose, with generated API documentation and an admin dashboard. Authy ships with a public demo and an embeddable widget for teams moving off SMS delivered passcodes.