Node.js: Build the Back End and APIs
Build a secure REST API with a database and login, using only what Node.js already includes
One payment of $39. Instant online access to the full written course. No subscription. Refund policy.
You build a secure API with a database that a front end can use: a REST API with accounts, login, private data for each user, automated tests and a deployment you can show to others.
Who it is for. People who know basic JavaScript and want to build the server side of an app: front-end learners who need an API to call, career changers, freelancers and small-team developers. You do not need any back-end experience, and you install no packages.
You finish with. The Tasks API: a REST API with login, tested and ready to deploy. Assemble everything into one project that another person could clone, run, test and use. The API has accounts, login, private tasks for each user, a SQLite database built from migrations, automated tests, a smoke test and a short README. You show it running either on a host you chose or through the fresh-clone path on your own computer, and you review your own work route by route.
Certificate. Finish every lesson, resolve every quiz question with at least 50% right on the first try, and tick the capstone checklist — Apex Flow Academy issues a verifiable Certificate of Completion with a unique ID and a public verification page. It is a certificate of completion, not a degree, licence, accreditation or exam result.
01 · How the Web Back End Works4 lessons
Learn the picture behind every back end: a client sends a request and a server sends a response. Set up Node.js, run your first script, write your first real server, read what a request says, and answer with proper status codes.
- 1.1What a back end doesFREE
- 1.2Your first server
- 1.3Read what a request says
- 1.4Answer with the right status code
02 · Design and Build a REST API4 lessons
Plan the API as a contract of routes and rules, build a small router, read JSON bodies safely, and finish with a working create, read, update and delete API that keeps its tasks in memory.
- 2.1Design the contract: routes and rules
- 2.2Build a tiny router
- 2.3Read a JSON body safely
- 2.4Create, read, update and delete tasks
03 · Store Data in SQLite4 lessons
Learn the SQL you need, keep user input out of your queries, move the tasks from memory into a real database file, and change tables safely over time with numbered migration files.
- 3.1Talk to SQLite with SQL
- 3.2Keep user input out of your SQL
- 3.3Move the tasks into the database
- 3.4Change tables safely with migrations
04 · Users, Passwords and Login4 lessons
Store passwords the safe way, let people register, give them a session token when they log in, and put a guard in front of the task routes so that only logged-in users can reach them.
- 4.1Store passwords the safe way
- 4.2Register a user
- 4.3Log in and get a token
- 4.4Protect routes with a guard
05 · Ownership, Tests and Safe Failures4 lessons
Close the hole from Module 4 so that users see only their own tasks, prove it with automated tests, make every failure predictable and quiet, and let a browser front end on another address call your API.
- 5.1Give every task an owner
- 5.2Test your API with node:test
- 5.3Fail safely: errors, logs and headers
- 5.4Let a browser front end call your API (CORS)
06 · Configure, Protect, Deploy and Hand Over4 lessons
Move settings out of the code, slow down password guessers, run the API the way a host would run it, and finish the capstone: a tested, reviewed and documented REST API with login.
- 6.1Keep settings and secrets out of the code
- 6.2Slow down password guessers
- 6.3Deploy and smoke test
- 6.4Final review and hand-over
What a back end does
You will be able to
- Say what a back end does for a web page or an app.
- Name the four parts of every web exchange: client, request, server and response.
- Run a JavaScript file with Node.js on your own computer.
Why this matters
Every app you use has a hidden half. When you log in, save a note or check an order, a program on another computer does the work. That program is the back end. This course builds one from an empty folder. If you hold one simple picture in your head first, every later lesson has a place to fit.
Learn it
Think of a restaurant. You do not walk into the kitchen. You tell a waiter what you want, and the waiter brings back the food. The web works the same way.
- The client is whatever asks for something: a web page, a phone app or a script. It is the customer.
- The request is the order. It says what the client wants, such as the list of tasks.
- The server is a program that waits for requests and answers them. It is the kitchen. A back end is a server plus the rules and stored data behind it.
- The response is the answer the server sends back.
An API (application programming interface) is the menu. It lists what a client may ask for and what comes back. In this course the API is a set of web addresses, such as /tasks, that other programs can call.
Data usually travels as JSON. This is a plain-text format for structured data. It looks like a JavaScript object with double quotes around the names, for example {"title":"Buy milk","done":false}. Almost every language can read JSON, so a web page, a phone app and a Python script can all use one back end.
Node.js runs JavaScript outside the browser. So the language you already know can also build the kitchen. Node is free.
You will build one project, the Tasks API. It has accounts, login, and tasks that belong to each person. Every lesson adds one small piece, and by the end it is ready to run on the internet. A code block that starts with Save as is a complete file. Save it exactly as shown.
Get ready:
- Download the LTS version of Node from nodejs.org. LTS means long-term support. Use Node 22.13 or newer. The code here was run on Node 24, and the Node documentation lists each feature we use as available from 22.13.
- Open a terminal: Terminal on a Mac or Linux, or PowerShell on Windows.
- Type
node --versionand press Enter. You should see v22.13 or a higher number. - Type
npm --version. The tool npm comes with Node. You will use it to run scripts, but you will not install any packages in this course.
See it in action
Before a real server, here is the whole idea in a few lines. The function answer plays the server. It takes a request object and returns a response object.
Save as scratch/hello.js:
Run it with node scratch/hello.js. You get:
$ node scratch/hello.js
{ status: 200, body: { message: 'Hello!' } }
{ status: 404, body: { error: 'Not found' } }The first request asked for /hello, which exists, so the status is 200, which means OK. The second asked for /nope. The server has no such page, so it answered 404, which means not found. A real server does exactly this, but over a network.
Common mistakes
- Typing
nodealone. This opens a prompt where you type code. Press Ctrl+C twice to leave it, then runnodefollowed by a file name. - Running a command from the wrong folder. Node then says it cannot find the file. Use
cd tasks-apifirst, then try again. - Retyping code by hand and missing a character. Copy whole files instead, and keep the first comment line, because it tells you the file name.
You are done when
node --version shows v22.13 or higher, and node scratch/hello.js prints the two lines shown above.
You finished the free lesson
That is one lesson from the course. The full course gives you every remaining lesson, a quick check and a hands-on task in each one, and the workbook of templates and checklists.
Full course$39
- A Windows, macOS or Linux computer with an internet connection
- Node.js 22.13 or newer, free from nodejs.org (the code was run on Node 24)
- A code editor, for example Visual Studio Code (free)
- A terminal and a web browser (both already on your computer)
- Git (free) for the last module. The fresh-clone path in Module 6 needs no online account
- Optional: a free GitHub account and a free hosting account for a real deployment. Free hosting plans change, may ask for a payment method, and can erase SQLite data on restart, so check the host's current terms
- No paid subscription and no npm packages are needed for any core lesson
- Basic JavaScript: variables, functions, objects, arrays, conditions and loops
- You can open a terminal and run commands such as cd and node
- You have used a code editor to create and save files
The Tasks API: a REST API with login, tested and ready to deploy
Assemble everything into one project that another person could clone, run, test and use. The API has accounts, login, private tasks for each user, a SQLite database built from migrations, automated tests, a smoke test and a short README. You show it running either on a host you chose or through the fresh-clone path on your own computer, and you review your own work route by route.
- The project folder (or repository) with the source files, the four migration files, `.gitignore` and `.env.example`, and no secrets committed
- A passing `npm test` run: all 24 tests green, including the ownership test with two users and the failure-path tests
- Smoke test output with eight PASS lines, from your own computer and, if you deployed, from the deployed address
- Either the deployed address or the output of the fresh-clone path from Module 6
- The five-question review table filled in for all nine routes, with any gaps you fixed
- A README that lets a stranger run and use the API, with an honest list of known limits
- The browser demo page working from a different origin than the API
- A short written note explaining three security decisions in your own words: password hashing, token hashing and the owner check
- Client
- Whatever asks the server for something: a web page, a phone app or a script.
- Server
- A program that waits for requests and answers them.
- Request and response
- A request is the question a client sends. A response is the answer the server sends back.
- API
- The list of requests a server understands and the answers it gives, like a menu that other programs can order from.
- JSON
- A plain-text format for structured data that looks like a JavaScript object and that almost every language can read.
- Status code
- A three-digit number on every response that says how the request went, such as 200 for OK or 404 for not found.
- Route
- One rule that says which function answers which method and path, for example GET /tasks.
- Router
- The part of the server that looks at the method and path of a request and picks the right function to answer it.
- Handler
- A function that answers one kind of request.
- REST
- A set of habits for API design: addresses name things in the plural, and the method names the action.
- Header
- A labelled extra value sent with a request or response, such as the type of content or a login token.
- Query string
- The part of an address after the question mark, made of key=value pairs.
Browse the full Academy encyclopedia
22 checks were run and recorded while writing this course (code, formulas, commands and facts), and it lists 33 official sources it was checked against. Prices, features and policies of outside tools can change, so check each tool's own website.
Created by Apex Flow Academy with AI assistance. For education only; not legal, tax, financial or medical advice. Results depend on your effort and circumstances.
Python From Zero: Write Programs That Work
You write and run real Python programs from the first lesson, and you finish with three small working tools that you built yourself, tested with checks you wrote, and can change without starting over.
Python Automation: Make the Computer Do Your Boring Work
You automate files, spreadsheets, email drafts and web lookups that eat your week. You finish with your own script that plans before it acts, keeps a log, is tested against sample data, and runs on a schedule.
SQL: Ask Any Database Any Question
You will be able to write SQL that answers business questions from a database: choose and sort columns, filter rows, summarise and group, join tables, and check that your numbers are right. You finish with a report you built and checked yourself.