What next

You've got Express HTTP, JWT auth, mail, reset, Prisma as an ORM option, sessions, file CRUD, WebSockets, and caching. That's enough to stop being scared of /api - and of "realtime" / "just cache it" buzzwords.

If you want more structure

• NestJS - Angular-flavored DI, modules, decorators. Great when the team wants guardrails; heavy for tiny APIs.
• Fastify - similar to Express, often faster, schema-happy. Plugins instead of a giant middleware pile.
• Hono / Elysia - modern, TypeScript-first, sometimes on the edge. Worth a look if you're already in that ecosystem.

Express knowledge transfers: routing, middleware ideas, req/res mental models.

Deepen what you just touched

Chapter	Natural next step
ORM	Postgres + Prisma migrate deploy; Drizzle if you miss SQL
Sessions	connect-redis store, CSRF strategy for cookie apps
Files	S3/R2 uploads, signed URLs, image pipelines
WebSockets	Socket.IO rooms, Redis adapter, presence
Caching	Redis TTLs, CDN/edge cache, cache-aside patterns

OAuth / social login

Passport.js strategies, or "Sign in with…" via a provider SDK. Bigger surface (redirects, state cookies, account linking). Add when a product asks for it - not before.

Testing

• supertest against createApp() without listening
• Hit /api/auth/register → /login → /api/me in one test file
• For WS: open a client in the test, assert a broadcast after POST /api/notes

That's high ROI for an API like ours.

Deploy (short)

• Fly.io / Railway / Render / a VPS with Node
• Put secrets in the host's env UI
• Use Postgres managed DB when SQLite file disks get awkward
• Reverse proxy + HTTPS (Caddy / nginx); proxy WebSockets too (Upgrade headers)

Ops deep-dives aren't this tutorial - your FE deploy instincts (env vars, health checks) still apply.

Companion code

Keep playing with:

• examples/notes-api - JWT, files, WebSockets
• examples/prisma-sketch - Prisma-shaped notes CRUD

Extend notes CRUD, add requireVerified, break things on purpose.

Cross-links in the lab

If you liked the notes style:

• PHP / Laravel / Symfony / SQL tutorials under /lab/… on lukaszkups.net - same voice, different stack

Soft close

You don't need to memorize Express. You need to recognize the pipelines: middleware → route → DB → JSON, auth rituals, uploads as metadata + bytes, and sockets when HTTP polling gets silly.

Hope this made the server side feel less like a black box.

Enjoy!

Best,

-- ł.