Advanced RESTful API Development with Node.js and Express.js (Real-World Example)

In our last guide, *Building a RESTful API using Node.js and Express.js*, we explored the fundamentals of creating an API. Now, let’s take things further. In this follow-up, we’ll build a real-world Task Management API that includes user authentication, JWT tokens, secure CRUD operations, and MongoDB integration.

If you’re a business exploring custom API integration or **Custom Software Development**, these steps reflect exactly how production APIs are built.

1. Project Setup

mkdir task-api && cd task-api
npm init -y
npm install express mongoose dotenv bcryptjs jsonwebtoken cors morgan

Structure:

task-api/
 ├─ config/db.js
 ├─ models/User.js, Task.js
 ├─ routes/authRoutes.js, taskRoutes.js
 ├─ middleware/
 ├─ server.js

2. Database & Models

MongoDB + Mongoose gives us schema flexibility.

User Model:

const mongoose = require("mongoose");
const userSchema = new mongoose.Schema({
  name: String,
  email: { type: String, unique: true },
  password: String
});
module.exports = mongoose.model("User", userSchema);

Task Model:

const taskSchema = new mongoose.Schema({
  title: String,
  completed: { type: Boolean, default: false },
  user: { type: mongoose.Schema.Types.ObjectId, ref: "User" }
}, { timestamps: true });
module.exports = mongoose.model("Task", taskSchema);

3. Authentication with JWT

Register & Login Routes:

const bcrypt = require("bcryptjs");
const jwt = require("jsonwebtoken");

// Register user
router.post("/register", async (req, res) => {
  const { name, email, password } = req.body;
  const hashed = await bcrypt.hash(password, 10);
  await User.create({ name, email, password: hashed });
  res.json({ message: "User registered" });
});

// Login
router.post("/login", async (req, res) => {
  const { email, password } = req.body;
  const user = await User.findOne({ email });
  if (!user || !(await bcrypt.compare(password, user.password)))
    return res.status(401).json({ message: "Invalid credentials" });

  const token = jwt.sign({ id: user._id }, process.env.JWT_SECRET, { expiresIn: "1d" });
  res.json({ token });
});

4. Protecting Routes

Middleware:

const protect = (req, res, next) => {
  const token = req.headers.authorization?.split(" ")[1];
  if (!token) return res.status(401).json({ message: "No token" });
  try {
    const decoded = jwt.verify(token, process.env.JWT_SECRET);
    req.user = decoded.id;
    next();
  } catch {
    res.status(401).json({ message: "Invalid token" });
  }
};

5. Task Routes

// Create task
router.post("/", protect, async (req, res) => {
  const task = await Task.create({ ...req.body, user: req.user });
  res.json(task);
});

// Get tasks
router.get("/", protect, async (req, res) => {
  const tasks = await Task.find({ user: req.user });
  res.json(tasks);
});

6. Testing with Postman

1. POST /api/auth/register → Register user
2. POST /api/auth/login → Receive JWT token
3. Add a token in Authorization: Bearer <token>
4. Call /api/tasks → Manage tasks

7. Deploying

• Push to GitHub
• Deploy to Heroku or Render
• Configure environment variables (MONGO_URI, JWT_SECRET)

For enterprise-level solutions, check out **Web Development Services and [Custom API Development](https://apipilot.com/services/custom-api-development/)**.

Final Thoughts

In Part 1, we set the foundation. In this continuation, we’ve built a real-world REST API with:

• MongoDB for persistence
• JWT authentication
• Secure CRUD operations
• Deployment readiness

This is the same workflow professional developers follow for production-grade systems.

If you want help building custom web applications or scaling APIs for your business, the **API Pilot team specializes in secure, scalable web and API solutions**.