A Hands-On Guide to Designing, Building, Securing, Testing, and Deploying a Real API

Read before you buy: the PDF here is a free sample — the first 20 pages of the 487-page book (payments, sales and reviews on this demo site are sample data). Get the full e-book at thenexbooks on Gumroad.

Go beyond "Hello World" and build an API you would be proud to put in production.

The first endpoint is easy. What comes next is where most tutorials stop: validating every input, returning consistent errors, storing data safely in a real database, preventing two requests from grabbing the same record, logging people in without leaking passwords, protecting routes by role, accepting uploads, testing everything, documenting the API, and running it in production where it restarts cleanly and tells you when something is wrong.

This book walks through all of it by building one complete API step by step, with one clear, modern stack and no framework survey.

What's inside

• How HTTP, JSON, and REST work, and how Node.js handles many requests at once
• A first server with node:http, then routes, middleware, and complete CRUD with Express 5
• Correct status codes, headers, Location, PATCH vs PUT, and consistent problem-details errors
• Input validation with Zod for bodies, query strings, and path parameters
• PostgreSQL with node-postgres: parameterized queries, a repository layer, migrations, and seed data
• Joins and transactions that prevent double-lending, plus pagination, filtering, sorting, and search
• Password hashing with Argon2, JSON Web Tokens with jose, roles, and ownership checks
• CORS, Helmet, rate limiting, safe input handling, and secure image uploads
• Testing with node:test and Supertest, plus OpenAPI 3.1 documentation with Swagger UI
• Validated configuration, structured logging with Pino, caching, ETags, and query tuning
• Versioning, idempotency keys, and optimistic concurrency with If-Match
• Scheduled jobs, reminder emails, signed webhooks, Docker, cloud deployment, health checks, and graceful shutdown

One running example, start to finish. You build Lendshelf, the API behind a neighborhood tool-lending library, with members, librarians, a tool catalog, loans, and reservations. It is small enough to understand completely and real enough to need everything a production API needs.

Practical and current. Modern JavaScript with ES modules on a current Node.js LTS, curl examples with PowerShell notes, and Tips, Notes, Warnings, exercises, and Key Takeaways in every chapter. No invented benchmarks.

Format: PDF, 487 pages (A4), linked table of contents and bookmarks. English. First Edition, 2026. Published by thenexbooks.

Table of Contents

Part I — Getting Started

• Ch 1 · What Is a REST API? HTTP, JSON, and the Web in Plain Words
• Ch 2 · Setting Up: Node.js, npm, an Editor, and Tools for Calling APIs
• Ch 3 · Node.js Essentials for API Developers: Modules, async/await, and the Event Loop
• Ch 4 · Your First Server with node:http
• Ch 5 · Planning the Lendshelf API: Resources, Endpoints, and Project Structure

Part II — Building with Express

• Ch 6 · Express 5 Fundamentals: Routes, Requests, and Responses
• Ch 7 · Middleware: The Request Pipeline
• Ch 8 · CRUD Endpoints Done Right: Status Codes, Headers, and JSON
• Ch 9 · Validating Input with Zod
• Ch 10 · Error Handling and Consistent Error Responses

Part III — Data and Persistence

• Ch 11 · PostgreSQL Basics for API Developers
• Ch 12 · Connecting with node-postgres: Pools, Queries, and Parameters
• Ch 13 · Migrations and Seed Data
• Ch 14 · Relationships, Joins, and Transactions
• Ch 15 · Pagination, Filtering, Sorting, and Search

Part IV — Security

• Ch 16 · Authentication: Password Hashing and JSON Web Tokens
• Ch 17 · Authorization: Roles, Ownership, and Protecting Routes
• Ch 18 · API Security Essentials: CORS, Helmet, Rate Limiting, and Safe Input
• Ch 19 · File Uploads: Images, Limits, and Storage

Part V — Quality and Documentation

• Ch 20 · Testing Your API with node:test and Supertest
• Ch 21 · Documenting Your API with OpenAPI and Swagger UI
• Ch 22 · Configuration, Environment Variables, and Structured Logging
• Ch 23 · Performance Basics: Caching, ETags, Compression, and Query Tuning
• Ch 24 · Evolving Your API: Versioning, Idempotency, and Concurrency

Part VI — Shipping

• Ch 25 · Background Work: Scheduled Jobs, Emails, and Webhooks
• Ch 26 · Deploying with Docker and a Cloud Platform
• Ch 27 · Production Readiness: Health Checks, Graceful Shutdown, and Monitoring
• Ch 28 · Case Study: Lendshelf from Empty Folder to Production

Appendices
A · Cheat Sheet
B · Templates and Reference
C · API Launch Checklist
D · Glossary

Book details