REST API development, from contract to production
Soham Dang designs and builds REST APIs on Node.js and Express.js, with authentication, role-based access control, verified webhooks and the MongoDB work that determines whether they stay fast.
An API is a contract. Most of the pain in building one comes from that contract being discovered rather than agreed — the client assumes one shape, the server returns another, and the difference is found during integration.
Designing the contract first is unglamorous and saves more time than any other single practice.
How an API gets built
Contract
Endpoints, shapes, error cases and auth requirements agreed before implementation, so both sides can proceed in parallel.
Middleware foundation
Validation, authentication, tenancy and error handling as composable layers every route inherits.
Handlers and data access
Thin handlers over a data layer where the schema and indexes have been designed for the queries being made.
Hardening
Rate limiting, webhook signature verification, security review and load-shaped performance testing before it carries traffic.
What gets included
Authentication
JWT sessions and OAuth sign-in, with refresh handling and sensible token lifetimes.
Authorisation
Role-based access control checked in middleware, including multi-tenant scoping where the product needs it.
Integrations
Payment gateways such as Razorpay, media pipelines such as Cloudinary, and messaging via the WhatsApp Business API.
Webhooks
Signature-verified inbound webhooks, so state changes are driven by the provider's event rather than a browser redirect that may never arrive.
Performance
Aggregation pipelines for computed responses, compound indexes from explain plans, and query optimisation under concurrent load.
AI tool layers
MCP servers and OpenAI-backed endpoints that expose data through permission-checked tools rather than raw database access.
Common questions
What does Soham Dang use to build REST APIs?
Node.js and Express.js, with MongoDB and Mongoose for data, JWT and OAuth for authentication, and role-based access control enforced in middleware. Services have run behind Nginx routing in production.
Why do payment integrations use webhooks rather than redirects?
A browser redirect can be closed, blocked or lost, which means an order or enrolment silently fails after a successful payment. A signature-verified webhook is driven by the payment provider's own event, so state changes when the payment actually clears.
Can Soham Dang optimise an existing slow API?
Yes. The usual causes are missing compound indexes on real query paths, rollups computed in application code rather than MongoDB aggregation pipelines, and N+1 access patterns — all of which are addressable without a rewrite.