API & Backend Development

URL versioning (/v1/, /v2/) for public APIs consumed by mobile apps or third parties — breaking changes in a new version, old versions maintained for a deprecation window. Header versioning for internal APIs between services. I document the versioning strategy and deprecation policy in the OpenAPI spec from day one.

Yes — always. I use NestJS decorators that generate OpenAPI 3.0 specs automatically, which feed into Swagger UI for interactive docs. API documentation is not optional — it's what makes your API usable by other developers and reduces your support burden. The Reg CF backend shipped with 30 documented endpoints.

OAuth 2.0 + OIDC for user-facing APIs (using Clerk, Auth0, or self-hosted). API keys with HMAC signing for machine-to-machine. JWT with short expiry and refresh token rotation. RBAC at the resource level, not just route level. I never store passwords — bcrypt with proper salt rounds, or delegate to an identity provider.

Yes — WebSocket gateways in NestJS with room-based broadcasting, Redis pub/sub for horizontal scaling across multiple server instances, and Server-Sent Events for simpler one-directional use cases. I also build background job queues (BullMQ) for async processing and deliver results via WebSocket when complete.

Unit tests for service logic (Jest), integration tests against a real test database (not mocks — I've been burned by mock/prod divergence too many times), contract tests for external integrations (Pact), and load tests (k6) before production. CI runs all three on every PR. The Reg CF backend carries 248 passing tests and has had zero production bugs.