Building Scalable APIs with Node.js and Express

Creating scalable APIs is essential for modern web applications. This guide covers best practices for building production-ready APIs with Node.js and Express.

Architecture Overview

A well-designed API follows a clear architecture pattern:

text
routes → controllers → services → models → database

Routes

Define your API endpoints and map them to controllers.

js
// routes/users.js
const express = require('express');
const router = express.Router();
const userController = require('../controllers/userController');

router.get('/', userController.getUsers);
router.post('/', userController.createUser);
router.get('/:id', userController.getUserById);

module.exports = router;

Controllers

Handle request and response logic.

js
// controllers/userController.js
const User = require('../models/User');

exports.getUsers = async (req, res) => {
  try {
    const users = await User.find();
    res.json(users);
  } catch (error) {
    res.status(500).json({ error: error.message });
  }
};

Services

Encapsulate business logic.

js
// services/userService.js
const User = require('../models/User');

exports.getAllUsers = async () => {
  return await User.find();
};

exports.createNewUser = async (userData) => {
  const user = new User(userData);
  return await user.save();
};

Error Handling

Implement comprehensive error handling:

js
// middleware/errorHandler.js
const errorHandler = (err, req, res, next) => {
  console.error(err.stack);
  
  const status = err.status || 500;
  const message = err.message || 'Internal Server Error';
  
  res.status(status).json({ error: { status, message } });
};

module.exports = errorHandler;

Authentication & Authorization

Secure your APIs with proper authentication:

js
// middleware/auth.js
const jwt = require('jsonwebtoken');

const authenticate = (req, res, next) => {
  const token = req.headers.authorization?.split(' ')[1];
  
  if (!token) {
    return res.status(401).json({ error: 'No token provided' });
  }
  
  try {
    const decoded = jwt.verify(token, process.env.JWT_SECRET);
    req.user = decoded;
    next();
  } catch (error) {
    res.status(403).json({ error: 'Invalid token' });
  }
};

module.exports = authenticate;

Best Practices

1. Use Environment Variables - Never hardcode sensitive data
2. Implement Rate Limiting - Protect against abuse
3. Validate Input - Use libraries like Joi or Yup
4. Log Everything - Use Winston or Morgan for logging
5. Write Tests - Use Jest or Mocha for testing

Conclusion

Building scalable APIs requires careful planning and adherence to best practices. By following these patterns, you'll create maintainable and efficient APIs.