Skip to content

Backend Engineering

APIs, business logic, and the work that happens after the response.

RESTGraphQLWebSocketsauthenticationauthorizationsessionsJWTservice layerbackground jobsqueuesworkerscronwebhooks

Lessons

  1. 3.1REST vs GraphQL vs WebSockets (and SSE)Three ways for apps to talk to your backend. Each fits a different kind of conversation, and many real systems use more than one. 30 min Booking API playground
  2. 3.2Authentication, authorization, sessions and JWTsWho are you, and what are you allowed to do? Two different questions. Here's how login works, how the app remembers you, and where most breaches really happen. 30 min Booking API playground
  3. 3.3Background jobs and queuesHow to answer the user in a blink while the slow stuff, like emails and PDFs, gets done a moment later. 30 min Retries, backoff and circuit breakers
  4. 3.4Webhooks: receiving and sending events over HTTPInstead of asking "anything new?" every few seconds, you let other systems call you when something happens. Here's how to do it safely. 30 min Payment succeeded, booking crashed

On the job: try it on your own project

Ask Claude Code to list every API endpoint, background job, cron task and incoming webhook in your backend, with how each one is authenticated. Mark any endpoint with no auth check, any job with no retry, and any webhook with no signature check. Write a one-page backend inventory with your top three risks and share it with your lead.

Can you do this now?

0/4. Anything you can't tick yet: reopen that lesson's practice ladder.