Backend development: the layer judged on its worst day
Backend work here covers Node.js and Express services, REST API architecture, authentication and multi-tenant access control, and the MongoDB design that decides whether any of it stays fast.
A backend is not judged on the request that goes right. It is judged on the malformed payload, the third party returning a 500, the duplicate webhook, and the query that was fine until the collection reached a million documents.
Everything below is about that.
The layers
Validation at the edge
Requests checked before they reach a handler, so business logic never has to defend against shapes it should never have seen.
Authentication and authorisation
JWT sessions and OAuth sign-in, with role-based access and tenant scoping applied in middleware so no endpoint can forget them.
Structured errors
One error surface returning consistent, useful responses instead of leaking internals or silently swallowing failures.
Idempotent integrations
Signature-verified webhooks that can be delivered twice without charging twice or enrolling twice.
Data access designed for the query
Indexes, aggregation pipelines and document shapes chosen from real access patterns.
Operational reality
Services have run behind Nginx routing in production, deployed through CI/CD to Vercel and Render, with environment configuration and monitoring treated as part of the build rather than a follow-up ticket.
Rate limiting, API security review and backend performance tuning are ongoing work, not a phase — which is the only way they actually happen.
Integrations that have shipped
Razorpay payments with backend webhook verification driving order and enrolment state. Cloudinary for media pipelines. The WhatsApp Business API for notifications and task assignment. n8n for workflow automation.
And OpenAI-backed endpoints plus MCP servers, where the tool layer applies the same permission checks as the rest of the API before the model sees anything.
Common questions
What backend stack does Soham Dang use?
Node.js and Express.js with MongoDB and Mongoose, JWT and OAuth for authentication, role-based access control in middleware, and deployment via CI/CD to Vercel or Render, with services having run behind Nginx in production.
How is multi-tenant data isolation handled?
In middleware, so every data access inherits tenant scoping rather than each endpoint applying it individually. Compound indexes are led by the tenant key so the scoping helps performance rather than costing it.
Can Soham Dang take over an existing backend?
Yes. Extending and restructuring live production services is most of what the work has been, including API security review and performance tuning on systems already carrying traffic.