Node.js Backend Development for Mobile Apps

Imagine your mobile app hits 100,000 users, but the server starts choking—timeouts, data loss, delayed push notifications. To avoid this, you need a well-designed Node.js backend development. Node.js + TypeScript is a pragmatic choice: fast startup, JSON-native, huge ecosystem. Our team has 5+ years of experience and has delivered 30+ Node.js backends for mobile apps. We guarantee performance and security. We use best practices: Fastify, Prisma, JWT with rotation, and automated CI/CD. This article covers the stack, architecture, and common mistakes, and shows how to avoid performance and security issues. MVP backend development starts from $3,000 (auth + 3 CRUD + push). Full-featured backend with realtime and payments from $8,000.

Why Node.js for Mobile Backend?

Node.js processes up to 20,000 requests per second on a single core thanks to the event loop. For mobile projects, low latency and realtime features (chats, likes, notifications) are critical. Fastify is our go-to for new projects: it's 20–30% faster than Express, has built-in validation via JSON Schema, and native TypeScript support. Here's an endpoint example:

// Fastify + TypeScript + Zod validation import Fastify from 'fastify'; import { z } from 'zod'; const app = Fastify({ logger: true }); const CreatePostSchema = z.object({ title: z.string().min(1).max(200), content: z.string().min(1), authorId: z.string().uuid(), }); app.post('/posts', async (request, reply) => { const body = CreatePostSchema.parse(request.body); const post = await postService.create(body); return reply.status(201).send(post); }); 

Database: PostgreSQL with Prisma ORM. Prisma generates a type-safe client and simplifies migrations. Here's a query with related entities:

const user = await prisma.user.findUnique({ where: { id: userId }, include: { posts: { take: 10, orderBy: { createdAt: 'desc' } } }, }); 

Comparison of Fastify and Express in mobile APIs:

How to Implement Mobile Client Authentication?

For mobile apps, we use JWT authentication with short-lived access tokens (15 minutes) and long-lived refresh tokens (30 days). Refresh tokens are stored in a refresh_tokens table—this allows invalidating all sessions on password change. According to the JWT specification (RFC 7519), tokens are signed to ensure integrity. This approach reduces compromise risk and complies with App Store Review Guidelines (Section 5.1).

Steps:

1. Generate token pair on login.
2. Store refresh token in DB.
3. Middleware for access token verification.
4. Endpoint for token refresh.
5. Rotate refresh token on each refresh.

import jwt from 'jsonwebtoken'; export const generateTokens = (userId: string) => ({ accessToken: jwt.sign({ sub: userId, type: 'access' }, process.env.JWT_SECRET!, { expiresIn: '15m', }), refreshToken: jwt.sign({ sub: userId, type: 'refresh' }, process.env.JWT_REFRESH_SECRET!, { expiresIn: '30d', }), }); // Verification middleware export const authMiddleware = async (request: FastifyRequest, reply: FastifyReply) => { const token = request.headers.authorization?.replace('Bearer ', ''); if (!token) return reply.status(401).send({ error: 'Unauthorized' }); try { const payload = jwt.verify(token, process.env.JWT_SECRET!) as JwtPayload; request.userId = payload.sub!; } catch { return reply.status(401).send({ error: 'Invalid token' }); } }; 

Push Notifications and Realtime: Avoiding Pitfalls

We configure push notifications via Firebase Admin SDK. For bulk sending, we use sendEachForMulticast in batches of 500 tokens, removing invalid ones. Realtime features (chat, likes) are implemented via WebSocket (ws or socket.io). For horizontal scaling, we add Redis Pub/Sub. This handles up to 50,000 concurrent connections per server.

import * as admin from 'firebase-admin'; admin.initializeApp({ credential: admin.credential.cert(serviceAccount) }); export const sendPushNotification = async ( fcmToken: string, title: string, body: string, data?: Record<string, string> ) => { const message: admin.messaging.Message = { token: fcmToken, notification: { title, body }, data, apns: { payload: { aps: { sound: 'default', badge: 1 } }, }, android: { priority: 'high', notification: { sound: 'default' }, }, }; return admin.messaging().send(message); }; 

import { WebSocketServer } from 'ws'; const wss = new WebSocketServer({ server: httpServer }); const connections = new Map<string, WebSocket>(); wss.on('connection', (ws, request) => { const userId = getUserIdFromRequest(request); connections.set(userId, ws); ws.on('close', () => connections.delete(userId)); }); export const notifyUser = (userId: string, event: object) => { const ws = connections.get(userId); if (ws?.readyState === WebSocket.OPEN) { ws.send(JSON.stringify(event)); } }; 

Why Fastify Over Express for Mobile APIs?

Fastify delivers up to 30% performance gain through an optimized router and async parsing. JSON Schema validation is free—no need for extra libraries. For mobile projects, this means faster responses and lower server costs. With Express, you get a larger ecosystem but more manual work for validation and typing. Fastify is for those who value speed and reliability.

Common Mistakes in Node.js Backend Development

1. Blocking operations in event loop: large JSON.parse, synchronous fs. Use worker threads or queues.
2. N+1 in Prisma: without include, each query spawns individual requests. Always use include or $queryRaw.
3. No rate limiting: mobile client can generate request bursts. Fastify Rate Limit with Redis solves this.

Backend Development Process: Step-by-Step

1. Analysis: define requirements, load, agree on API contract (OpenAPI).
2. Design: architecture, stack selection, infrastructure setup.
3. Implementation: write code, set up CI/CD, cover with tests (unit + integration).
4. Testing: load testing, security checks.
5. Deployment: deploy to production, monitoring and alerts.

Timelines: MVP backend (auth + 3-5 resources + push) — 2–3 weeks. Full-fledged backend with realtime and payments — 1–3 months.

What's Included in Our Backend Development Package

• API documentation (OpenAPI/Swagger)
• Database schema and migrations
• Deployment scripts and CI/CD pipelines
• Admin panel or API access
• Training for your team (2 hours)
• 1 month of post-launch support

Ready to evaluate your project? Contact us for a free consultation. Get a detailed development plan and accurate timeline estimate.