| name | software-backend |
| description | Production-grade backend API development with Node.js 24 LTS/25 Current (Express 5.x/Fastify 5.2/NestJS 11.x), Python 3.14+ (FastAPI 0.115+), Go 1.25+, Rust 1.91+ (Axum 0.8+), Prisma 6.x ORM, PostgreSQL 18. Includes GraphQL, TypeScript 5.9+ strict mode, modern logging (Pino/Winston), secret managers, PM2 process management, and Prisma Accelerate for serverless/edge deployments. |
Backend Engineering Skill — Quick Reference
This skill equips backend engineers with execution-ready patterns for modern API development, database design, authentication, caching, observability, error handling, testing, and deployment. Claude should apply these patterns when users ask for REST/GraphQL API design, database schema modeling, authentication flows, performance optimization, or production-grade backend architectures.
Modern Best Practices (December 2025): GraphQL adoption, TypeScript 5.9+ strict mode enforcement (TypeScript 7 "Corsa" Go-based compiler in preview with 10x speedup), unknown over any, Prisma Accelerate for serverless, PM2 process management, structured logging (Pino/Winston), secret managers (AWS Secrets Manager, HashiCorp Vault), and enhanced security with Helmet.js.
Quick Reference
| Task | Tool/Framework | Command | When to Use |
|---|---|---|---|
| REST API | Express 5.x / Fastify 5.2 / NestJS 11.x | npm create express-app |
Traditional CRUD APIs, public APIs |
| GraphQL API | Apollo Server/Pothos | npm install @apollo/server |
Flexible data fetching, avoiding over-fetching |
| Database ORM | Prisma 6.x / Drizzle | npx prisma init |
Type-safe database access, migrations |
| Authentication | JWT/NextAuth.js/Passport | npm install jsonwebtoken |
User sessions, API authentication |
| Validation | Zod/Joi | npm install zod |
Runtime type validation at API boundaries |
| Caching | Redis/Upstash | npm install ioredis |
Read-heavy operations, session storage |
| Background Jobs | BullMQ/Agenda | npm install bullmq |
Email sending, async processing |
| Testing | Vitest/Jest/Supertest | vitest run |
Unit, integration, E2E testing |
| Logging | Pino/Winston | npm install pino |
Structured logging, observability |
| API Documentation | Swagger/OpenAPI | @nestjs/swagger |
Auto-generated API docs |
When to Use This Skill
Claude should invoke this skill when a user requests:
- REST or GraphQL API design and implementation (GraphQL adoption increasing)
- Database schema design and migrations (Prisma schema-first approach, Prisma Accelerate for serverless)
- Authentication and authorization patterns (JWT, OAuth2, sessions, NextAuth.js)
- Error handling and validation strategies (Zod/Joi TypeScript-first validation)
- API security best practices (Helmet.js headers, OWASP API Security Top 10, rate limiting)
- Performance optimization and caching (Redis, Prisma connection pooling, singleton pattern)
- Testing strategies (Vitest, Jest, Playwright for E2E, supertest for API testing)
- Background job processing (BullMQ, Agenda)
- API documentation and versioning (Swagger/OpenAPI auto-generation)
- Deployment and production readiness (PM2 process management, Docker, secret managers)
- Monitoring and observability (structured logging with Pino/Winston, Sentry, OpenTelemetry)
Decision Tree: Backend Technology Selection
Backend project needs: [API Type]
├─ REST API?
│ ├─ Simple CRUD → Express 5.x + Prisma 6.x
│ ├─ Enterprise features → NestJS 11.x (built-in DI, modules)
│ └─ High performance → Fastify 5.2 (faster than Express)
│
├─ GraphQL API?
│ ├─ Code-first → Pothos GraphQL (TypeScript)
│ └─ Schema-first → Apollo Server + GraphQL Codegen
│
├─ Authentication Strategy?
│ ├─ JWT tokens → jsonwebtoken + httpOnly cookies
│ ├─ OAuth/Social → NextAuth.js or Passport.js
│ └─ Magic links → Custom implementation + email service
│
├─ Database Layer?
│ ├─ Type-safe ORM → Prisma 6.x (best for TypeScript)
│ ├─ SQL-first → Drizzle ORM or Kysely
│ └─ Raw SQL → pg (PostgreSQL 18 driver)
│
├─ Caching Strategy?
│ ├─ Distributed cache → Redis (multi-server)
│ ├─ Serverless cache → Upstash Redis
│ └─ In-memory cache → Node.js Map (single server)
│
└─ Background Jobs?
├─ Complex workflows → BullMQ (Redis-backed, retries)
└─ Simple scheduling → node-cron or Agenda
Language Alternatives:
- Node.js 24 LTS / 25 Current (Express 5.x / Fastify 5.2 / NestJS 11.x + Prisma 6.x): TypeScript-first, async/await, Web Storage API
- Python 3.14+ (FastAPI 0.115+ + SQLAlchemy 2.0+): ML/DS backends, async support, free-threaded Python, t-strings
- Go 1.25+ (Fiber 2.x + GORM 1.25+): High concurrency, native performance, experimental encoding/json/v2
- Rust 1.91+ (Axum 0.8+ + SeaORM 1.1+): Memory safety, zero-cost abstractions, Rust 2024 edition
See templates/ for language-specific starter templates.
Navigation
Resources
- resources/backend-best-practices.md — Node.js patterns for auth, error handling, database, performance, testing, observability
- resources/go-best-practices.md — Go idioms, concurrency, error handling, GORM usage, testing, profiling
- resources/rust-best-practices.md — Ownership, async, Axum, SeaORM, error handling, testing
- resources/python-best-practices.md — FastAPI, SQLAlchemy, async patterns, validation, testing, performance
- README.md — Folder overview and usage notes
- data/sources.json — External references per language/runtime
Shared Utilities (Centralized patterns — extract, don't duplicate)
- ../_shared/utilities/auth-utilities.md — Argon2id, jose JWT, OAuth 2.1/PKCE
- ../_shared/utilities/error-handling.md — Effect Result types, correlation IDs
- ../_shared/utilities/config-validation.md — Zod 3.24+, Valibot, secrets management
- ../_shared/utilities/resilience-utilities.md — p-retry v6, opossum v8, OTel spans
- ../_shared/utilities/logging-utilities.md — pino v9 + OpenTelemetry integration
- ../_shared/utilities/testing-utilities.md — Vitest, MSW v2, factories, fixtures
- ../_shared/utilities/observability-utilities.md — OpenTelemetry SDK, tracing, metrics
- ../_shared/resources/code-quality-operational-playbook.md — Canonical coding rules & review protocols
Templates
- templates/nodejs/template-nodejs-prisma-postgres.md — Node.js + Prisma + PostgreSQL
- templates/go/template-go-fiber-gorm.md — Go + Fiber + GORM + PostgreSQL
- templates/rust/template-rust-axum-seaorm.md — Rust + Axum + SeaORM + PostgreSQL
- templates/python/template-python-fastapi-sqlalchemy.md — Python + FastAPI + SQLAlchemy + PostgreSQL
Related Skills
- ../software-architecture-design/SKILL.md — System decomposition, SLAs, and data flows
- ../software-security-appsec/SKILL.md — Authentication/authorization and secure API design
- ../ops-devops-platform/SKILL.md — CI/CD, infrastructure, and deployment safety
- ../qa-resilience/SKILL.md — Resilience, retries, and failure playbooks
- ../software-code-review/SKILL.md — Review checklists and standards for backend changes
- ../qa-testing-strategy/SKILL.md — Testing strategies, test pyramids, and coverage goals
- ../dev-api-design/SKILL.md — RESTful design, GraphQL, and API versioning patterns
- ../data-sql-optimization/SKILL.md — SQL optimization, indexing, and query tuning patterns
Operational Playbooks
- resources/operational-playbook.md — Full backend architecture patterns, checklists, TypeScript notes, and decision tables