What is Building REST APIs with Node.js?

Complete guide to building scalable REST APIs using Node.js, Express, and MongoDB.

Who wrote this Building REST APIs with Node.js tutorial?

This tutorial was written by Shiv Shankar Prasad, an experienced developer sharing programming knowledge on ItsIndianGuy.in

Building REST APIs with Node.js | ItsIndianGuy Blog

Building REST APIs with Node.js, Express, and MongoDB is a powerful combination for creating scalable, performant backend services. This comprehensive guide covers everything from project setup to production deployment, including best practices, security, and optimization techniques.

REST (Representational State Transfer) APIs have become the standard for web services, providing a simple, scalable way for applications to communicate. Node.js, with its non-blocking I/O model and event-driven architecture, is perfectly suited for building high-performance APIs that can handle thousands of concurrent connections. When combined with Express's minimalist framework and MongoDB's flexible document model, you have a stack that can adapt to any requirements.

This stack, often referred to as the MERN stack (minus React), powers millions of applications worldwide, from startups to Fortune 500 companies. Its popularity stems from JavaScript being used across the entire stack, enabling developers to work seamlessly between frontend and backend. The thriving ecosystem provides libraries and tools for every need, from authentication to real-time communication, making it possible to build complex applications quickly and efficiently.

Why Node.js for REST APIs?

Node.js has become the go-to choice for building REST APIs due to its event-driven, non-blocking I/O model. Combined with Express and MongoDB, you get a powerful, flexible stack that scales beautifully.

🌐 Express Framework

Fast, unopinionated web framework with robust routing, middleware support, and extensive ecosystem.

• Minimal and flexible
• Rich middleware ecosystem
• Easy to learn and use

🗄️ MongoDB Integration

Flexible NoSQL database with JSON-like documents, perfect for modern applications.

• Schema flexibility
• Horizontal scaling
• Rich query language

Project Setup & Structure

🚀 Initial Setup

Terminal

# Initialize project
mkdir my-api && cd my-api
npm init -y

# Install dependencies
npm install express mongoose dotenv cors helmet
npm install -D nodemon

# Install TypeScript (optional but recommended)
npm install -D typescript @types/express @types/node

📁 Recommended Project Structure

Project Structure

src/
├── config/          # Configuration files
│   └── database.js
├── controllers/     # Request handlers
│   └── userController.js
├── models/          # Database models
│   └── User.js
├── routes/          # API routes
│   └── userRoutes.js
├── middleware/      # Custom middleware
│   └── auth.js
├── utils/           # Utility functions
│   └── validation.js
└── server.js        # Entry point

Building Your First API

1. Setup Express Server

server.js

const express = require('express');
const mongoose = require('mongoose');
const cors = require('cors');
const helmet = require('helmet');

const app = express();

// Middleware
app.use(helmet());
app.use(cors());
app.use(express.json());
app.use(express.urlencoded({ extended: true }));

// Routes
app.use('/api/users', require('./routes/userRoutes'));

// Error handling
app.use((err, req, res, next) => {
  res.status(err.status || 500).json({
    error: { message: err.message }
  });
});

const PORT = process.env.PORT || 3000;
app.listen(PORT, () => console.log(`Server on port ${PORT}`));

2. Create Mongoose Model

models/User.js

const mongoose = require('mongoose');

const userSchema = new mongoose.Schema({
  name: {
    type: String,
    required: [true, 'Name is required'],
    trim: true
  },
  email: {
    type: String,
    required: [true, 'Email is required'],
    unique: true,
    lowercase: true,
    match: [/^\S+@\S+\.\S+$/, 'Invalid email']
  },
  password: {
    type: String,
    required: [true, 'Password is required'],
    minlength: 8,
    select: false
  },
  role: {
    type: String,
    enum: ['user', 'admin'],
    default: 'user'
  }
}, { timestamps: true });

module.exports = mongoose.model('User', userSchema);

3. Implement Controllers

controllers/userController.js

const User = require('../models/User');

exports.getUsers = async (req, res, next) => {
  try {
    const users = await User.find().select('-password');
    res.json({ success: true, data: users });
  } catch (error) {
    next(error);
  }
};

exports.createUser = async (req, res, next) => {
  try {
    const user = await User.create(req.body);
    res.status(201).json({ success: true, data: user });
  } catch (error) {
    next(error);
  }
};

exports.getUserById = async (req, res, next) => {
  try {
    const user = await User.findById(req.params.id);
    if (!user) {
      return res.status(404).json({
        success: false,
        error: 'User not found'
      });
    }
    res.json({ success: true, data: user });
  } catch (error) {
    next(error);
  }
};

Essential Middleware & Security

🔒 Authentication

Implement JWT-based authentication for secure API access.

• Use bcrypt for password hashing
• Store JWT in httpOnly cookies
• Implement refresh tokens

🛡️ Request Validation

Validate all incoming data with libraries like Joi or express-validator.

• Validate request body
• Sanitize user input
• Return clear error messages

⚡ Rate Limiting

Protect your API from abuse with rate limiting.

• Use express-rate-limit
• Set appropriate limits
• Return 429 status code

📝 Logging

Implement comprehensive logging with Winston or Morgan.

• Log all requests
• Track errors and exceptions
• Use log levels appropriately

Best Practices & Tips

✅ Use Environment Variables

Store sensitive data like API keys, database URLs in .env files. Never commit secrets to version control.

✅ Implement Proper Error Handling

Use try-catch blocks, async error handlers, and centralized error handling middleware for consistent error responses.

✅ Version Your API

Use URL versioning (e.g., /api/v1/users) to maintain backward compatibility when making breaking changes.

✅ Document Your API

Use Swagger/OpenAPI for interactive API documentation. Makes integration easier for frontend teams and external developers.

⚙️

Build Production-Ready APIs

With Node.js, Express, and MongoDB, you have all the tools needed to build scalable, secure REST APIs. Follow these best practices and patterns to create APIs that perform well and are easy to maintain.

Remember: Always validate input, handle errors gracefully, secure your endpoints, and document your API thoroughly. Happy coding!

Why Node.js for REST APIs?

🌐 Express Framework

Fast, unopinionated web framework with robust routing, middleware support, and extensive ecosystem.

• Minimal and flexible
• Rich middleware ecosystem
• Easy to learn and use

🗄️ MongoDB Integration

Flexible NoSQL database with JSON-like documents, perfect for modern applications.

• Schema flexibility
• Horizontal scaling
• Rich query language

Project Setup & Structure

🚀 Initial Setup

Terminal

# Initialize project
mkdir my-api && cd my-api
npm init -y

# Install dependencies
npm install express mongoose dotenv cors helmet
npm install -D nodemon

# Install TypeScript (optional but recommended)
npm install -D typescript @types/express @types/node

📁 Recommended Project Structure

Project Structure

src/
├── config/          # Configuration files
│   └── database.js
├── controllers/     # Request handlers
│   └── userController.js
├── models/          # Database models
│   └── User.js
├── routes/          # API routes
│   └── userRoutes.js
├── middleware/      # Custom middleware
│   └── auth.js
├── utils/           # Utility functions
│   └── validation.js
└── server.js        # Entry point

Building Your First API

1. Setup Express Server

server.js

const express = require('express');
const mongoose = require('mongoose');
const cors = require('cors');
const helmet = require('helmet');

const app = express();

// Middleware
app.use(helmet());
app.use(cors());
app.use(express.json());
app.use(express.urlencoded({ extended: true }));

// Routes
app.use('/api/users', require('./routes/userRoutes'));

// Error handling
app.use((err, req, res, next) => {
  res.status(err.status || 500).json({
    error: { message: err.message }
  });
});

const PORT = process.env.PORT || 3000;
app.listen(PORT, () => console.log(`Server on port ${PORT}`));

2. Create Mongoose Model

models/User.js

const mongoose = require('mongoose');

const userSchema = new mongoose.Schema({
  name: {
    type: String,
    required: [true, 'Name is required'],
    trim: true
  },
  email: {
    type: String,
    required: [true, 'Email is required'],
    unique: true,
    lowercase: true,
    match: [/^\S+@\S+\.\S+$/, 'Invalid email']
  },
  password: {
    type: String,
    required: [true, 'Password is required'],
    minlength: 8,
    select: false
  },
  role: {
    type: String,
    enum: ['user', 'admin'],
    default: 'user'
  }
}, { timestamps: true });

module.exports = mongoose.model('User', userSchema);

3. Implement Controllers

controllers/userController.js

const User = require('../models/User');

exports.getUsers = async (req, res, next) => {
  try {
    const users = await User.find().select('-password');
    res.json({ success: true, data: users });
  } catch (error) {
    next(error);
  }
};

exports.createUser = async (req, res, next) => {
  try {
    const user = await User.create(req.body);
    res.status(201).json({ success: true, data: user });
  } catch (error) {
    next(error);
  }
};

exports.getUserById = async (req, res, next) => {
  try {
    const user = await User.findById(req.params.id);
    if (!user) {
      return res.status(404).json({
        success: false,
        error: 'User not found'
      });
    }
    res.json({ success: true, data: user });
  } catch (error) {
    next(error);
  }
};

Essential Middleware & Security

🔒 Authentication

Implement JWT-based authentication for secure API access.

• Use bcrypt for password hashing
• Store JWT in httpOnly cookies
• Implement refresh tokens

🛡️ Request Validation

Validate all incoming data with libraries like Joi or express-validator.

• Validate request body
• Sanitize user input
• Return clear error messages

⚡ Rate Limiting

Protect your API from abuse with rate limiting.

• Use express-rate-limit
• Set appropriate limits
• Return 429 status code

📝 Logging

Implement comprehensive logging with Winston or Morgan.

• Log all requests
• Track errors and exceptions
• Use log levels appropriately

Best Practices & Tips

✅ Use Environment Variables

Store sensitive data like API keys, database URLs in .env files. Never commit secrets to version control.

✅ Implement Proper Error Handling

Use try-catch blocks, async error handlers, and centralized error handling middleware for consistent error responses.

✅ Version Your API

Use URL versioning (e.g., /api/v1/users) to maintain backward compatibility when making breaking changes.

✅ Document Your API

Use Swagger/OpenAPI for interactive API documentation. Makes integration easier for frontend teams and external developers.

Build Production-Ready APIs

Remember: Always validate input, handle errors gracefully, secure your endpoints, and document your API thoroughly. Happy coding!

Building REST APIs with Node.js

Shiv Shankar Prasad

Why Node.js for REST APIs?

🌐 Express Framework

🗄️ MongoDB Integration

Project Setup & Structure

🚀 Initial Setup

📁 Recommended Project Structure

Building Your First API

1. Setup Express Server

2. Create Mongoose Model

3. Implement Controllers

Essential Middleware & Security

🔒 Authentication

🛡️ Request Validation

⚡ Rate Limiting

📝 Logging

Best Practices & Tips

✅ Use Environment Variables

✅ Implement Proper Error Handling

✅ Version Your API

✅ Document Your API

Build Production-Ready APIs

📢Share this article

Want More Content Like This?

Why Node.js for REST APIs?

🌐 Express Framework

🗄️ MongoDB Integration

Project Setup & Structure

🚀 Initial Setup

📁 Recommended Project Structure

Building Your First API

1. Setup Express Server

2. Create Mongoose Model

3. Implement Controllers

Essential Middleware & Security

🔒 Authentication

🛡️ Request Validation

⚡ Rate Limiting

📝 Logging

Best Practices & Tips

✅ Use Environment Variables

✅ Implement Proper Error Handling

✅ Version Your API

✅ Document Your API

Build Production-Ready APIs