⚙️

Backend Path

Backend developers handle data, logic, authentication, and servers. If you enjoy systems, data flow, and performance, this path is for you.

1Pick a language

Node.js (JavaScript on the server) is a great first choice because it's the same language as the browser. Python is equally beginner-friendly. Later you might explore Go, Java, or Rust.

A tiny Node.js + Express server

import express from "express";
const app = express();

app.get("/api/hello", (req, res) => {
  res.json({ message: "Hello from the server!" });
});

app.listen(3000, () => console.log("Running on port 3000"));

2HTTP & REST APIs

The web runs on requests and responses. A client asks the server for something using an HTTP method, and the server responds with data (usually JSON) and a status code.

HTTP methods (REST conventions)

GET     /api/posts       → read a list
GET     /api/posts/42    → read one post
POST    /api/posts       → create a new post
PUT     /api/posts/42    → replace a post
DELETE  /api/posts/42    → delete a post

Status codes to memorize

2xx  success        (200 OK, 201 Created)
3xx  redirect
4xx  client error   (400 Bad Request, 401 Unauthorized, 404 Not Found)
5xx  server error   (500 Internal Server Error)

Test your API. Use curl, Postman, or your browser's dev tools to send requests and inspect responses while you build.

3Databases & SQL

Start with a relational database like PostgreSQL or SQLite. Data lives in tables of rows and columns, and you query it with SQL.

SQL basics

-- create a table
CREATE TABLE posts (
  id SERIAL PRIMARY KEY,
  title TEXT NOT NULL,
  published BOOLEAN DEFAULT false
);

-- read rows
SELECT * FROM posts WHERE published = true;

-- add a row
INSERT INTO posts (title) VALUES ('My first post');

CRUD. Almost every app is just Create, Read, Update, Delete on some data. Master CRUD and you can build most backends.

4Authentication & security

Learn how sessions, JWTs, and password hashing work. A few non-negotiable rules:

Never store passwords in plain text — hash them (e.g. bcrypt).
Keep secrets in environment variables, never in your code.
Validate and sanitize all user input to prevent injection attacks.
Use HTTPS everywhere.

Secrets live in env vars, not code

// .env  (never commit this file)
DATABASE_URL=postgres://user:pass@host/db
JWT_SECRET=super-secret-value

// server.js
const secret = process.env.JWT_SECRET;

5Deployment & DevOps basics

Deploy your first API to a cloud platform. Learn environment variables, logging, error handling, and basic CI/CD. Understanding Docker is a nice bonus.

Beginner project ideas

REST API for a blog with posts and comments
URL shortener service
User authentication system (sign up / log in)
Task management API with a database

Next: connect it to a frontend

Knowledge Check

Test what you learned. Each correct answer earns XP. up to 65 XP

1. Which HTTP method is conventionally used to create a new resource?

2. What does an HTTP 404 status code mean?

3. In SQL, which statement reads rows from a table?

4. What is an environment variable typically used for?

5. Why do APIs usually return JSON?