𝟱 𝗣𝗿𝗼𝗱𝘂𝗰𝘁𝗶𝗼𝗻 𝗠𝗶𝘀𝘁𝗮𝗸𝗲𝘀 𝗜 𝗠𝗮𝗱𝗲 𝗪𝗶𝘁𝗵 𝗘𝘅𝗽𝗿𝗲𝘀𝘀 𝗔𝗣𝗜𝘀
APIs do not break because of complex code.
They break because you ignore boring details.
I learned these five lessons from real production errors.
- Validate data early
I used to validate data inside my business logic. This caused bugs far from the source.
Now I kill bad requests immediately.
If a request lacks a valid email, return a 400 error right away. Do not let bad data reach your main logic.
- Use specific error codes
A generic 500 error helps no one.
If an API key fails, return a 401 error. If a user lacks credits, return a 402 error.
If you need to explain an error in Slack, your API message failed.
- Check your middleware order
I spent hours debugging authentication issues. The problem was just the order of my middleware.
Follow this order:
- CORS first
- JSON parsing second
- Authentication third
- Routes last
One wrong line breaks everything.
- Log the right data
I tried many logging styles. Most were useless.
For standard tracking, log the method, path, and status code.
For errors, log the request ID, the error message, and the stack trace.
Anything else is noise when you wake up at 3 AM.
- Set rate limits
I watched an endpoint get hit so hard it cost real money.
An API without limits relies on hope. Hope is not a security strategy.
Use express-rate-limit to protect your server.
Most API failures come from ignoring basics.
Production does not care about your plans. It only cares about your setup.
Source: https://dev.to/manolito99/5-production-mistakes-that-changed-how-i-build-express-apis-133e