Xano Checklists | Development Standards

New API Endpoint

Building any new Xano endpoint — auth, permissions, validation, response format, reusable functions, documentation

Reusable Function

Extracting shared logic into a Xano Custom Function — naming, single responsibility, inputs/outputs, error raising, testing

Webhook Endpoint

Building a Xano webhook receiver — signature verification, idempotency, payload handling, response standards, logging

Quick Reference — Core Xano Rules

Auth token validation is the first step in every protected endpoint
Role is always read from the database — never from the request payload
Workspace membership verified before any data is read or written
All inputs validated before any business logic runs
Errors returned in standard format: { status, code, message }
Shared logic with 3+ uses extracted to a Xano Function
Every endpoint documented before frontend handoff
Every endpoint tested for success, unauthorized, forbidden, not found, duplicate, validation error

Related Standards

Xano Standards Backend-First Logic Code Reusability Standards