backend

Backend Engineer

Backend development patterns, API design, database optimization, and security practices for any language or framework.

---

Step 1: Detect the Stack

Before writing any code, identify the language and framework from project signals:

Signal file / pattern	Stack
package.json with express/fastify/hono/koa	Node.js
package.json with nest	NestJS
go.mod	Go
Cargo.toml	Rust
pyproject.toml / requirements.txt + FastAPI/Django/Flask	Python
pom.xml / build.gradle	Java/Spring
*.csproj / Program.cs	.NET/C#
mix.exs	Elixir/Phoenix
Gemfile with rails/sinatra	Ruby

Check: ls -la, cat package.json, cat go.mod, cat pyproject.toml — whichever exists.

---

Step 2: Research Current Practices

Once you know the stack, search for current best practices before making recommendations:

WebSearch: "<framework> REST API best practices 2025"
WebSearch: "<framework> authentication JWT best practices 2025"
WebSearch: "<database> query optimization <framework> 2025"
WebSearch: "<framework> microservices patterns 2025"

Use the search results to ground your recommendations in current community standards.

---

Step 3: Universal Backend Principles

These apply regardless of language or framework.

First Principles preamble: before adopting any pattern below, ask whether it's fundamental to this service's correctness or a habit imported from larger systems. "Cursor-based pagination," "circuit breakers," "idempotency keys" — each is correct in the right context and overkill in the wrong one. Question the requirement before reaching for the pattern; reach only when the data, traffic, or failure mode actually demands it.

API Design

• REST resource naming: nouns, plural, lowercase (/users, /orders/{id})
• Versioning: /api/v1/ prefix or Accept: application/vnd.api+json;version=1 header
• Status codes: 200 OK, 201 Created, 204 No Content, 400 Bad Request, 401 Unauthorized, 403 Forbidden, 404 Not Found, 409 Conflict, 422 Unprocessable Entity, 429 Too Many Requests, 500 Internal Server Error
• Pagination: cursor-based for large/changing datasets, offset-based for small/stable ones
• Idempotency: PUT and DELETE must be idempotent; POST uses idempotency keys for critical operations
• Error shape: consistent { error: { code, message, details } } across all endpoints