APIs and Errors in Express.js

APIs and Errors is the sixth chapter of the free Express.js tutorial. It turns everything so far into a complete JSON API that fails safely and knows who is calling.

What each lesson covers:

  • Building REST APIs: Resources, versioned routers, filtering, sorting and paging, full CRUD, PUT versus PATCH, status codes, one consistent JSON shape and OpenAPI docs.
  • Error Handling: How errors reach Express, async errors in Express 5, error middleware, custom error classes, 404 handlers and safe production errors.
  • Token Authentication and Authorization: Sessions versus tokens, JWTs, login and Bearer middleware, expiry and refresh tokens, roles and ownership checks, token storage, Passport and Google sign-in.

Every lab runs a real Express 5 server in your browser. Send requests with any method, body and headers from the lab's client panel.

Lessons in this section

  1. Building REST APIs

    REST basics, idempotency, API routers and versioning, collection routes with filtering, search, sorting, pagination and field selection, create, read, update and delete, PUT versus PATCH, status codes, consistent JSON and route structure.

    • Design resource URLs and versioned API routers
    • List collections with filters, sorting and pages
    • Create, read, update and delete resources
    • Choose the right REST status codes
  2. Error Handling

    Operational and programming errors, how errors reach Express, Express 5 async forwarding and its limits, error middleware, res.headersSent, custom error classes, 404 handling, HTML and JSON errors, and development versus production error output.

    • Explain how errors reach Express
    • Catch errors in callbacks and timers
    • Write central error middleware
    • Create custom error classes
  3. Token Authentication and Authorization

    Sessions versus tokens, how a JWT is built, login that signs tokens, Bearer middleware, expiry and refresh tokens, role and ownership checks, token storage, Passport and Google sign-in.

    • Explain authentication versus authorization
    • Sign and verify JWTs
    • Protect routes with Bearer middleware
    • Use short access tokens and refresh tokens