Node.js and Express API Development
An API is a contract that your web app, mobile app and partners all depend on. I build Express APIs in TypeScript where every input is validated at the edge, every error maps to the right HTTP status code, and every public route is rate limited, so the API behaves predictably under real traffic and real attackers.
Typical work includes authentication with short-lived JWTs and refresh tokens, two-factor login for admin users, role-based permissions checked on the server, multi-tenant data isolation, file uploads to object storage, and WebSocket channels for live features such as chat, presence and notifications.
I also take over existing Node.js APIs that have grown hard to change: adding validation and tests around the risky parts first, then fixing slow queries with the right MongoDB indexes, and replacing ad-hoc error handling with one consistent format your front end can rely on.
What's included
- REST API design and documentation
- Zod validation and consistent error responses
- Authentication: JWT, refresh tokens, TOTP two-factor and RBAC
- Multi-tenant data isolation on MongoDB
- Real-time features over WebSockets
- Rate limiting, logging, health checks and Docker deployment
How we'll work
- Contract first. Resources, endpoints, payloads and error codes agreed before code, so front-end work can start in parallel.
- Secure by default. Validation, auth, authorisation and rate limits are part of every endpoint, not a later phase.
- Test what matters. Integration tests against a real database for auth, permissions and money flows.
- Operate. Structured logs, health checks and graceful shutdown so the API can be deployed and debugged calmly.
Tech I use
Node.js · Express 5 · TypeScript · Zod · MongoDB · Mongoose · WebSockets · Docker
Case studies
Frequently asked questions
REST or GraphQL?
REST suits most business apps and caches well. I use GraphQL only when many clients need very different shapes of the same data.
How do you secure an Express API?
Validate every input, authenticate with short-lived tokens, check permissions on every request, rate-limit public routes and never leak internal errors.
Can you add features to my existing Node.js API?
Yes. I start by reading the code and adding tests around the area I will change.
Do you build real-time features?
Yes: chat, presence, live dashboards and notifications over WebSockets, as in ChatMessenger and MyCityHelp.