Backend Architecture
System design choices for APIs, databases, queues, reliability, observability, security, and operations under failure.
47 articles in this section.
REST API pagination: cursor tokens that do not leak database details
Cursor pagination should help a client continue from a stable position without exposing internal IDs, timestamps, or query assumptions. Treat the token ...
Redis queues and backpressure: stop accepting work you cannot finish
A queue protects an API only when it has a capacity policy. Without backpressure, the queue simply moves overload into memory, latency, and a later incident.
GraphQL query limits: depth, cost, and timeout controls that matter
GraphQL gives clients a flexible query surface, which means the server needs explicit limits. Depth, field cost, timeouts, and persisted operations work togethe
PostgreSQL indexes for API endpoints: measure before adding one
Adding an index can fix a slow endpoint or make writes and storage more expensive. The useful habit is to connect an index to a real query plan and a measured w
HTTP 429 explained: retry-after, backoff, and client behavior
A 429 response is not merely an error page. It is a conversation between a server protecting capacity and a client deciding whether, when, and how to try again.
Rate limiting explained: choose the right algorithm for your API
Compare fixed windows, sliding windows, token buckets, and leaky buckets, then choose a rate-limit design that is fair, observable, and safe to retry.
REST vs GraphQL: which API style should a small team choose?
A practical REST versus GraphQL comparison for teams choosing an API style, with guidance on caching, validation, versioning, errors, and operational cost.
AI agent architecture: tools, approvals, memory, and verification
A practical architecture for AI agents that can use tools without becoming an uncontrolled automation layer, including state, approvals, memory, and verification.
How to build a secure internal developer platform
A practical guide to self-service safety, with a concrete failure case, implementation trade-offs, and checks engineers can run before shipping.
Post-quantum cryptography: what application developers need to prepare for
A practical guide to crypto agility, with a concrete failure case, implementation trade-offs, and checks engineers can run before shipping.
Cloud cost control for AI workloads and databases
A practical guide to unit economics, with a concrete failure case, implementation trade-offs, and checks engineers can run before shipping.
Kubernetes for small teams: when it is unnecessary
A practical guide to operational fit, with a concrete failure case, implementation trade-offs, and checks engineers can run before shipping.
Platform engineering vs DevOps: what the difference means
A practical guide to platform ownership, with a concrete failure case, implementation trade-offs, and checks engineers can run before shipping.
OpenTelemetry for Node.js: traces, metrics, and logs
A practical guide to observability context, with a concrete failure case, implementation trade-offs, and checks engineers can run before shipping.
p99 latency explained with a real API benchmark
A practical guide to tail latency, with a concrete failure case, implementation trade-offs, and checks engineers can run before shipping.
How to test distributed systems when failures are nondeterministic
A practical guide to failure testing, with a concrete failure case, implementation trade-offs, and checks engineers can run before shipping.
Exactly-once processing: what backend engineers should actually promise
A practical guide to delivery guarantees, with a concrete failure case, implementation trade-offs, and checks engineers can run before shipping.
Outbox pattern explained with PostgreSQL and Node.js
A practical guide to transaction handoff, with a concrete failure case, implementation trade-offs, and checks engineers can run before shipping.
GitHub OAuth token rotation: how to migrate without logging everyone out
A practical GitHub OAuth token rotation guide: handle expiring access and refresh tokens, rotate safely, preserve sessions, and recover when users return with old credentials.
PostgreSQL 18.6 security update: a safe production upgrade guide
Patch PostgreSQL 18.6 safely, check GIN statistics, btree_gist and ltree indexes, and verify Node.js services after the August 2026 security release.
HTTP 103 Early Hints: when preloading helps and when it wastes bandwidth
Early Hints can start critical fetches before the final response, but incorrect hints compete with the resources a page actually.
OpenTelemetry in Node.js: trace one request across API, queue, and worker
Distributed tracing becomes useful when context survives asynchronous boundaries and span names describe operations rather than framework.
Designing a fraud detection event pipeline in Node.js
A practical Node.js fraud event pipeline with stable event contracts, idempotent consumers, rules, risk scores, review queues, audit logs, and replay safety.
Database restore tests: the backup step teams forget
Turn database backups into a tested recovery process with clear RPO and RTO targets, isolated restore drills, integrity checks, application tests, and evidence.
Background job idempotency: why workers repeat work in production
How to design idempotent background jobs so retries, crashes, and duplicate messages do not double-charge or double-send.
Audit logs for product apps: what should you record?
A practical audit logging guide for SaaS and backend apps: admin actions, auth events, data changes, exports, and privacy balance.
Password reset token design: small mistakes that create big risk
A practical guide to password reset tokens, expiration, single-use links, account enumeration, logging, and safe reset flows.
SameSite cookies explained: the setting that prevents many surprises
How SameSite cookie settings work, why they matter for login sessions, and where Strict, Lax, and None fit.
CORS misconceptions: why disabling it is not an API security plan
Understand what CORS actually controls, configure credentialed origins safely, debug preflights, and keep authentication and authorization as separate API boundaries.
Content Security Policy explained for normal web developers
A practical CSP guide with report-only rollout, strict policies, nonces, hashes, third-party scripts, reporting, and production checks.
API keys in frontend code: why this mistake keeps happening
Why API keys exposed in frontend bundles are not secret, what attackers can do, and safer patterns for browser apps.
Login rate limiting explained: protect the boring endpoint first
How to rate limit login endpoints, password reset flows, OTP checks, and account creation without punishing normal users.
Webhook replay attacks explained for backend developers
A simple guide to webhook replay attacks, timestamps, signatures, idempotency, and safe event processing in Node.js APIs.
Idempotency keys for APIs: how to stop duplicate payments and actions
How idempotency keys work in APIs, why retries create duplicates, and how backend developers can design safer mutation endpoints.
Object-level authorization explained: the API bug behind many leaks
A practical guide to object-level authorization, why login is not enough, and how backend developers can test cross-user access.
Next.js Server Actions security checklist for real apps
Secure Next.js Server Actions with in-action authorization, strict validation, safe return values, abuse limits, idempotency, logging, and negative tests.
GitHub Actions OIDC explained: stop storing long-lived cloud secrets
Replace long-lived deployment keys with GitHub Actions OIDC, narrow cloud trust by repository and environment, and test denial before deleting old secrets.
PostgreSQL 19 beta explained: should normal developers care yet?
A practical guide to PostgreSQL beta releases, why PostgreSQL 19 beta matters, and how teams can evaluate features safely.
PostgreSQL security update checklist for backend teams
How backend teams should respond to PostgreSQL security and bug-fix releases without breaking production databases.
OWASP API Security Top 10 explained for Node.js backend developers
Apply the OWASP API Security risks to Node.js routes with object-level authorization, schema validation, rate limits, inventory, logging, and abuse tests.
HTTP QUERY method explained: the new method between GET and POST
A practical guide to the new HTTP QUERY method, why RFC 10008 added it, how it compares with GET and POST, and when backend developers should care.
Cursor pagination vs offset pagination for APIs
A practical comparison of cursor pagination and offset pagination for backend APIs, including performance and user experience.
PostgreSQL indexes explained for backend developers
How PostgreSQL indexes speed up queries, when they hurt writes, and how backend developers should think about them.
Database transactions explained for backend developers
A practical explanation of database transactions, atomicity, rollbacks, isolation, and when backend code needs them.
Queue dead-letter pattern in Node.js: what to do with failed jobs
Design a Node.js dead-letter workflow with bounded retries, useful failure records, replay controls, idempotent workers, alerts, and safe operator recovery.
Webhook signature verification in Node.js: the part tutorials skip
Verify webhook signatures in Node.js without corrupting the raw body, avoid timing leaks, reject stale deliveries, and process valid events idempotently.
Rate limiting in Node.js with Redis: a practical guide
Build an atomic Redis rate limiter for Node.js, choose useful identities and limits, handle proxy IPs, and decide what happens when Redis is unavailable.