Senior Backend

Senior Backend

Guide backend development with focus on API design, database optimization, and security.

Core Workflow

1. Scaffold an API

Generate API boilerplate with best practices:

python scripts/api_scaffolder.py  [options]

2. Manage Database Migrations

Run the migration tool for schema changes:

python scripts/database_migration_tool.py  [--verbose]

3. Load Test APIs

Verify performance under load:

python scripts/api_load_tester.py [--analyze]

Reference Documentation

Consult before implementing:

• references/api_design_patterns.md -- REST/GraphQL patterns, versioning, error responses
• references/database_optimization_guide.md -- indexing, N+1 prevention, query tuning
• references/backend_security_practices.md -- auth, CORS, rate limiting, injection prevention

Key Principles

• Parameterized queries: Never concatenate user input into SQL
• Input validation: Use Zod schemas for all API request bodies
• Error responses: Return consistent error format with status code, message, and error code
• Auth checks: Verify user ownership on every data access (WHERE userId = ?)
• Idempotency: Design mutations to be safely retryable (especially webhooks)

API Design Checklist

1. Define Zod schema for request/response
2. Implement route handler with proper HTTP methods
3. Add authentication middleware
4. Add authorization check (ownership/role)
5. Validate input, execute logic, return typed response
6. Add error handling with appropriate status codes
7. Write integration test

Database Optimization Checklist

• Add indexes for frequently queried columns
• Use SELECT only needed columns (avoid SELECT *)
• Prevent N+1 with eager loading (include/join)
• Use connection pooling in production
• Add EXPLAIN ANALYZE for slow queries

Error Handling

• If migration fails: check database connection string and run npx prisma migrate status
• If load test shows high latency: check references/database_optimization_guide.md for indexing strategies
• If API scaffolder errors: verify Python 3.8+ and required templates exist in scripts/
• If auth fails: verify JWT_SECRET is set and token expiry is configured
• Always validate webhook signatures before processing payloads

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: Cor-Incorporated
• Source: Cor-Incorporated/claude-code-skills
• License: MIT

Install and usage instructions live in the source repository linked above.