Build a REST API with Node.js, Express, TypeScript, MongoDB & Zod

Repository: github.com/TomDoesTech/REST-API-Tutorial-Updated
❤️Host your applications and get 💰$100 credit (referral): m.do.co/c/1b74cb8c56f4
0:00 - Introduction
2:00 - API demo
5:45 - Code walk-through
8:20 - Bootstrap the application
26:00 - User registration
58:00 - Session Controller
1:43:38 - Product resource
📚 Concepts & technologies covered
- REST APIs
- JWTs & refresh tokens
- Node.js
- TypeScript
- MongoDB with Mongoose
- Request validation
🌎 Follow me here:
Discord: discord.gg/4ae2Esm6P7
Twitter: tomdoes_tech
Facebook: tomdoestech​
Instagram: tomdoestech​
TikTok: www.tiktok.com/@tomdoes_tech
☕ Buy me a coffee: www.buymeacoffee.com/tomn

[@TomDoesTech]

Learn how to test the REST API with the next video on the series: kzbin.info/www/bejne/qGavYouIj8Z2iJI

[@francisabonyi7115]

Thank so much for your effort, your courses are awesome.. Can you please add video for Redis cache on this video or another built project. Thanks

[@ravenMK_]

Man I love you already!

[@kittisakphatchaiphongsa3177]

@@francisabonyi7115 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

[@Islam_Eliwa]

you are amazing dude, thanks a lot

[@TomDoesTech]

​@@stevechude3730 my videos are not for beginners. If you don't know hwo to set up Mongo locally, this video is not for you. Please consider how rude you're being to people that spend hours making videos for free.

[@oz4549]

I have said it before and I will say it again. This tutorial is so good that I got an internship. However, do not just copy and paste what he did here. Take this and build on it or build something different using the practices in this tutorial, connect a frontend to show something, or integrate other things if you need. When he said "it will make any CTO weak at their knees", he was not lying. But really understand what he's trying to teach here and I know there are issues with some packages being outdated but go and research, hell, use a different tool or whatever. That's how you get good. I will never be thankful enough to him for this tutorial, I learned a great deal of stuff. Thank you man!

[@TomDoesTech]

This advice will land you a job, guaranteed

[@minhnghia107]

yah 2 years ago but still gold. I'm not going to intern yet but through this tutorial, my skills have improved. I decide to watch the tutorial and then redo it by myself :D

[@ochogwuemmy8171]

Great. But how do users login as there no route for login

[@aarondiaz2506]

super high quality content! I really like that you explain things like currying on the go, i mean you don't let anything unexplained on your code, thank you.

[@thiagocrux]

It's rare to find people who provide us with as much content as you do and even less with this quality. This video was immensely rich and I could learn a lot from it. Thanks, Tom!

[@truthalwaysprevails662]

This is not to take anything away from Tom and his wonderful tutorials, the one thing I have began to observe is that lesser the subscriber count the better is the quality of the tutorial. Definitely not every time but generally

[@ravenMK_]

Just exactly what I'm looking for and then there is you. I was meant to find you. Perfect timing. Thank you for this

[@osanyinbiyusuf7308]

I cant believe i have access to this kinda tutorial for free....the amount of knowledge passed here is quite overwhelming.....I appreciate you so much.....your tutorial has great impact in my life...Many thanks.

[@johnwick97t764]

These contents are way better and productive than other so call "paid courses". Thank you so much for your service

[@nonybrighto]

Migrating from js to typescript for express and I am really glad I found this! Wish I found it a little bit earlier. Would have saved me the stress of digging around for some things I know so far! Thanks a lot! You deserve a cofee!!

[@AesSedai2020]

Can I say I absolutely love your tutorials, I am learning so much! Thank you :)

[@hasanerken9604]

This is a very good and thorough explanation of how to implement TS on REST Api. Great video. I hope we will see a video on Fastify as well. Thanks Tom, for this great tutorial.

[@reknine]

Very nice structure in the project! I think I'll adapt this. Great stuff!

[@akash-kumar737]

Appreciate that you redirected to this new and updated video.

[@robertholl8914]

Good tutorial! A little tricky coming from more refined structured API environments to Express but made the experience as native and 'easy' as possible. Thanks!

[@axelpaul8988]

I love your channel and the tutorials you created. They are very helpful! It would be great if you could zoom in vscode with some software for zooming videos so it is easier to understand what's going on since I usually divide my screen in two pieces. One is the video and the other one is my IDE and when I do this, the characters from your IDE are pretty small. Overall, I love the channel and I'm very happy that you are getting more subscribers every day.

[@030426101993]

Just want to send a big Thank to you, Tom. I have learned a lot from this series.

[@pankaj_9998]

This channel is gold for nodejs reactjs devs. Thanks so much such valuable content 🙂

[@KennedyOtisNyaga]

Very educative and thanks for taking time to make these production level videos. Also another tip on omitting the password from response... one can add select: false in the model level. This will automatically omit the password field or any other field with select: false.

[@kimshares1487]

Thankyou I got a job and this is what I am using to learn the TypeScript perspective of Express. Kudos!

[@meetsamseen]

Thank you for this awesome tutorial Tom!

[@HighGamingDifficulty]

Love your tutorials, I am a beginner with TypeScript, it helps a lot, thank you!

[@TomDoesTech]

Great to hear!

[@Plaswin]

Thank you so much, love how clean your code looks

[@benjaminiduwe2958]

Great video, i really enjoy your series.

[@MiguelRodriguez-ng9wc]

Thank you for this tutorial, it's amazing c:!.

[@Creamworks]

Thank you very much for this, amazing tutorial ❤

[@adriantworek1057]

You do awesome job Tom providing such a robust content for free! Would like to see another part with creating UI, handling all these sessions etc. on the client side, preferably with Redux Toolkit or Context API.

[@TomDoesTech]

Thanks Adrian, I am working on the UI part. I'm going to keep the library use to a minimum because it could get confusing for anyone that doesn't know how that library works.

[@belkocik]

I love your tutorials!

[@ayushpaharia5452]

Would love to see Prometheus, caddy+docker and Jest testing. Really got into typescript watching your videos. Please keep creating this lovely content!

[@TomDoesTech]

I'm working on testing with Jets now, it will be out nest week, Prometheus should be quick so I will do that too :)

[@TomDoesTech]

I also have a video about caddy + docker here: kzbin.info/www/bejne/aKCxpJ2vlqh8qKs

[@jean-marcmockel7848]

Hey man! Outstanding value in these two hours. Thanks a lot for putting in the work. Can't wait to start the other videos in that playlist. One quick feedback from my side: You're kinda rushing through the tutorial and it's sometimes hard to follow in that pace. It would be great if you could explain certain things a little bit better like the overall architecture of the application and why you are doing certain things. I think it's always great to have the big picture from the beginning on. Keep up the great work!

[@TomDoesTech]

Thank you for the feedback. It's difficult to tell what pace the video should be because it really depends on how much experience the viewer has I think.

[@jean-marcmockel7848]

@@TomDoesTech Yeah I know what you mean. "Advanced" or "Beginner" is always subjective of course and a question what kind of audience you'd like to serve with your videos. More beginners or more advanced devs that might get bored out. But nonetheless, your content stays on a high quality! Thanks for your efforts, Tom.

[@mssafy2592]

man this was a master piece !

[@rafayzia4180]

Amazing content! keep em coming :)

[@nicklansbury3166]

I love how you _almost_ stopped yourself laughing at your CTO comment right at the beginning. Thanks for putting together what will no doubt be another excellent tutorial. Keep 'em coming.

[@TomDoesTech]

I thought about that joke for way too long.

[@IkraamDev]

Very nice. Hopefully I’ll do this tutorial in the weekend whilst practising Neovim at the same time!

[@TomDoesTech]

Never heard of Neovim, I'm going to download it and have a play around with it. let me know if you have any questions :)

[@rajeev3147]

Dude you are doing God's work. Highly appriciated

[@BarakAlmog]

Great tutorial! Thanks so much.

[@jerryzhang7022]

Thanks bro. Really nice tutorial.

[@ThisClark]

If you got stuck with 403 forbidden in Postman around 3:30 in the video, set environment variables and attach the environment to the current workspace. Here's a one minute demo of me going from 403 forbidden to 200 ok by setting the environment properly: kzbin.info/www/bejne/iYO7aXtthLKGZsU

[@siyanbolafaruk3005]

Thank you for creating this

[@adrianogonzalez5269]

Great video! loved to see a video on Apollo GraphQL

[@sergiyrudenko905]

Thank you Tom!!! Great lesson! Please make next lesson about deploying docker container on linux server!!!

[@kiefer8101]

Great video! More Express, TS, Prisma content pls!

[@AdityaKumar-gl1to]

Got what I needed !!!

[@umarmuhammadzakari4585]

Thank you so much for the video.

[@vinayaknaik9884]

You made my day♥

[@enogratechnologies1896]

Great tutorial. Thanks.

[@techOtuts]

Thanks for the wonderful tutorial. Please make a video on how to securely handle refresh token and access token on the frontend with react. I need this for a job please

[@rohitpandit3267]

thanks for this awesome content

[@wzup23]

Whoa didn't know that I can use postman like this. I always manually type my input whenever I test O_O. Yes, horrible! Thanks for this dude! Will be checking on your other videos.

[@maurolsmoura]

Excellent tutorial, thanks a lot

[@TomDoesTech]

Glad it was helpful!

[@irfanhariths]

Nice tutorial ! Suggestion for next video : Building a REST with prisma and mysql

[@clutchmadness]

I think this is the first time in my 'young' career that I've seen routes being handled like that. It's beautiful.

[@TomDoesTech]

So glad you like it :)

[@christopherugochukwu3517]

@@TomDoesTech when i hit the healthcheck route I get an error that says "unable to connect to remote server". but the console shows app is running on the designated port

[@TomDoesTech]

@@christopherugochukwu3517 are you using Mongo Atlas or something? What is the "remote server"?

[@zilvinas5130]

Overal great tutorial, one improvement I would suggest is putting more attention in small mistakes you make and fix during speed-up. Followed halfway through the tutorial to get my project's template to where I feel comfortable to develop it on my own. Huge thanks for for providing great starting point with a manageable folder structure and other methodologies!

[@TomDoesTech]

Thank you for the feedback, that's really helpful! When I make those mistakes, I stop talking while I try figure it out so I need to learn to keep talking and explain the issue.

[@stevereid636]

I agree, this is great tutorial, but you need to make sure to let us know when you’ve made a correction that been edited out. 🙏🏾 Otherwise excellent work👍🏾

[@gotmorris]

I would like to see more about testing the API. Thanks

[@dammyola]

Me as well

[@alanmejia6375]

You are great! Please make a video with full testing and React with TS. Well, Docker too! jaja

[@TomDoesTech]

Thanks! I am working on the testing video now :)

[@yassinebenlahbib1058]

thank you so much ❤️

[@geuxor]

Thanks for a great lesson! Would be great to see a repo for the same but with sequelize/postgres instead of mongoose :) Do you maybe have anything already?

[@Luka_brx]

TOM IS MVP

[@sohamvishwas6795]

Thank You😇

[@francisabonyi7115]

Your content is so amazing, please can make feature for roles and permission. thanks

[@vinayaknaik9884]

Thank you,

[@tenzl]

Hi Tom thanks for the video. Just a question on 1:35:18 why are we checking to see if there is no "_id" field in the decoded object? wouldn't it always be there if verifyJwt returns the decoded object?

[@julianvogel1277]

Man I love ur coding style =D

[@TomDoesTech]

Thank you so much :)

[@julianvogel1277]

@@TomDoesTech ur welcome =) Just one little question. When you call the createUserSessionHandler you are using the same private key for the accessToken and refreshToken. Isn't that a problem? Or are you changing that later. Cant't wait to watch the next videos of that series =D

[@politeboy2996]

Amazing codding standard

[@eissa178]

It would be top if you can make a new video, adding a new endpoint but this time using a TDD approach. This way, we could learn how an experienced developer writes code using TDD.

[@nelsonfleig5024]

Thank you so much Tom. This is excellente! What do you think about recreating this with Type-Graphql and Apollo? Seems to be a great stack for building modern graphql apps with Typescript.

[@TomDoesTech]

Yeah, I really like TypeGraphQL and have used it a fair bit so I think I will make a tutorial on it.

[@johnapple3471]

You have a very soothing voice

[@TomDoesTech]

Oh wow, thank you

[@devsami]

Hi, I watched your previous vidoe on the same, I liked this video far more than the previous, because in this session, we end user get to see and comprehend the code written, and it's not overwhelming when you explain by writing them. I was practicing it alongside, although I am getting type errors like "module mongoose has no exported member DocuemtDefinition" Can you please help me with that? Also, Is there another way to use the interface instead Omitting each field individually

[@randomcell708]

Hi Tom. great conent. I have learnt so much. Would you consider building out a React frontend for this, as it's always nice to produce something more visual to show as an end result

[@TomDoesTech]

I did that video kzbin.info/www/bejne/pYTdY2amhaejfLs&ab_channel=TomDoesTech

[@haans8]

I'm not sure if it's necessary to explicitly give type to the request and response on the route 2nd argument, because I'm sure that it's already inferred, CMIIW. Except if you need a specific property on the body or query.

[@JeffLevyForPresident]

Senior dev here. Like. Senior. Anyway, I've been mucking about for a few months porting an ancient (most of you were in grammar school when line 1 was laid down) PHP project over to Node. I've got quite a good grasp on node, but as we programmers are bent to do, we strive for different, better. I've never been quite satisfied with my port of this project. I decided to scrap what I think I know, and start anew. This 2-hour video is solid gold. A great, fresh, modern approach. Well done. Great structure, great pacing. Whilst not the audience you intended for this video, I find that I am able to easily pause the video, and consider my implementation vs. yours, and adapt my system in near-realtime. Outstanding work.

[@TomDoesTech]

I'm so glad you liked it! I think your approach is the best way to get the most out of the video. I try not to be too prescriptive in my videos. there are often better ways to do it. My goal is usually to give a suggestion and hope that the viewer pauses it and considers if they could improve on it. Thanks again for your kind words, I really appreciate it.

[@irahazda]

What are we supposed to set as accessTokenPrivateKey, accessTokenPublicKey, refreshTokenPrivateKey and refreshTokenPublicKey in the config/default.ts? I keep getting an error saying Configuration property "mykey" is not defined

[@samuelsilalahi4060]

Great tutorial. Bu I have questions. - Can you tell me how to upload files with this tutorial? - Can we validate the file with zod? Thank you

[@imigi427]

If someone had problem with: 'routines: get_header_and_data: bad end line', just check if your IDE do not add extra line while saving your document. In my case, 'prettier' extension added extra spaces on the beginng of every line. After correcting that I got my token keys. BTW. Thank You TomDoesTech for your yt tutorial ts with my node server. And your video is god blessing

[@alright83]

[ @1:20:39 of your video] Hi Tom, what's the difference in storing your user object in res.locals.user and req.user?

[@eminothedon716]

Can you explain to me why we're saving sessions to the db i don't get the concept ? is it to verify that we issued the tokens not someone else ??

[@swayamnayak7134]

Great video tom !! Can you please make a video on how to use typeorm with this server to interact with a sql database..

[@TomDoesTech]

Thanks, who's Tim?

[@swayamnayak7134]

@@TomDoesTech ohh sorry i mispelled tom as tim 😅

[@ivankraev4264]

Hey, can u explane how is "this as UserDocument" working ? I cant figure out

[@knumchoke]

I am new to javascript and typescript, can you recomend vscode extensions you were using in this project.

[@FudgeRaco]

Liked! Subscribed! Just wondering why you use Zod instead of Joi?

[@TomDoesTech]

Zod has better TS support and I'm more familiar with it

[@vladimirvucetic4466]

Hi thank you for great series. With this session/refresh token implementation should we care about stealing refresh token? Do you think that implementing refresh token rotation is overhead with your approach? Thanks

[@TomDoesTech]

Firstly, I'm not a security expert, I'm just demonstrating concepts here so if you're working with a lot of user data, make sure you have someone who understands security in-depth look at your code. Yeah, you should be worried about someone stealing the refresh token because if they have that, they can get an access token and then have access to the system. I would spend my effort trying to prevent the token from being stolen before I spend time reducing the blast radius in the event it does get stolen. So, what I mean by that is make sure you figure out how your application could be vulnerable to XSS attacks and reduce those threats. As for rotating refresh tokens. The issue is that you have no way to invalidate the refresh token without changing the public and private key pair. A lot of large companies will rotate their keys, but getting this to work without impacting the user experience would be challenging.

[@sreekumarmenon]

Awsome videos! suggestion for next video - Build a REST API with Node.js, Express, TypeScript, Prisma & Postgres.

[@TomDoesTech]

I did something very similar to this but I used Fastify instead of Express.

[@sreekumarmenon]

@@TomDoesTech Awesone,, could you share the link pls

[@TomDoesTech]

@@sreekumarmenon kzbin.info/www/bejne/gn7SfnuGaZlgrq8

[@sreekumarmenon]

@@TomDoesTech Thanks I like the folder structuree in that video better, controller,service,schema all in same folder grouped by feauture! question why pick zod over yup ?

[@TomDoesTech]

@@sreekumarmenon Zod has better TS support than Yup

[@janxavier8264]

"Make any CTO weak at the knees" 😆

[@farhanfauzan8355]

may i ask Tom? how about the sessions that being valid all the time? like it was actually never revoked or deleted in this case? is it safe to let a valid session recorderd event thou the actual accesst token or refresh token when the session is created is long time ago already expired?

[@andresbreuer]

Beautiful Tutorial!!! LOVED IT!! Just one question... Why do you prefer to use the config file for variables instead of enviroment variables? Is that secure?

[@TomDoesTech]

These 2 things aren't mutely exclusive. The con fig file has defaults which can be overwritten by env vars

[@DeepakKumar-ze8ii]

Hi Tom, I have a request! Is it possible to divide the long video as playlist in future bcz completing this video in one go is not possible and thanks for making this awesome video!!

[@TomDoesTech]

Sorry but longer videos do much better. I've done a few videos where they are in parts and they do significantly worse

[@joaquinsuarez499]

Amazing video, but why don't use eslint?

[@filipkajanovic1425]

Hello there! First of all, I realy love your tutorial(s). I'd like to ask little bit deeper about session handling => We are making new session every time user logs in. In longer term i feel like it's lot of unnecessary data in db so my questions are => 1) Should we reuse users preivouse session, or is that bad approach? 2) Should we keep them or would it be better to have some middleware that would once in time delete or old sessions? Or delete users preivouse session every time he logs in...? 3) Can we use them for storing history of users behavior? (Add new variable to Sessions & have some middleware that would push log that variable every time some endpoint is called from that session) Thank you & hope you're doing well 🙂

[@RaydenNnN]

just one tip, use status on your tutorials ;) forget to use 201 to create a new user, create sessions, etc

[@TomDoesTech]

Yup, good call!

[@zackOverflow]

This is awesome!!! thank you for this lesson. One request, can we make it a full stack app i.e. can we build a frontend to consume this API? thank you once again.

[@TomDoesTech]

There is a UI part in this series if you want to check that out

[@zackOverflow]

@@TomDoesTech ok, thanks so much. Meanwhile, i'll like to point out that, both your terminal & your file EXPLORER cover more than half of the screen in this video, it would be nice if you minimize your terminal when not in use that way, the viewers can have a clear view of the code on the screen. Thank you, you are the best.

[@5042DaMeatShoww]

Am I doing something wrong if my connections connect and after a few disconnect? I'm having an issue with my /healthcheck returning the Error Cannot GET /healthcheck

[@marcus_leon]

1:40:15 reIssueAccessToken is returning string or false, change the "return false" inside reIssueAccessToken to return "" , just a quick fix but can be fixed in many other ways

[@antoniosalzano5253]

export async function createProductHandler( req: Request, res: Response) {} Where can i read more about this filtering the request? I would like to understand more about this?

[@akshatgupta1658]

at 1:07:17 why are using spread operator like ...(options && options), an not simply ...options ? will in undefined case it produce error if we just use ...options?

[@TomDoesTech]

Yeah if options is undefined and you try spread it, essentially your're saying ...undefined which isn't valid and it will throw. You can default options to an empty object and it will work, but I use the ...(options && options) syntax because it works for all data types

[@RomainBARRAUD]

I keep on receiving Error: secretOrPrivateKey must be an asymmetric key when using RS256. Has anyone faced the same?

[@durveshparmar6775]

Hey that was great work and the one I was looking for... But I couldn't figure out how to generate refresh token private / public keys? is it same as access token private / public key process or different?

[@TomDoesTech]

You can use the same or different keys, up to you. Probably better to use different keys but it's not that big of a deal

[@Matiast9477]

If you're having problems with the pino logger config because of the deprecated prettyPrint prop import logger from "pino"; import dayjs from "dayjs"; const log = logger({ transport: { target: "pino-pretty", options: { colorize: true }, }, base: { pid: false, }, timestamp: () => `,"time":"${dayjs().format()}"`, }); export default log; this is the config

[@improving_cow]

THANKS BUDDY for this solution

[@James-ud7ys]

Is there a reason to use the routes function instead of express.Router()? Traditionally, I've seen the Router method used but wanted to know your thoughts. Great vid!

[@TomDoesTech]

It's just the way I'm used to doing it. I've used the express.Router() in another video

[@gorutorot]

Hello, thanks for the tutorial! I'm currently stuck on the getting all of a users sessions part. im console loggin the accesstoken in deserialize user and it doesnt exist. I realized this is because when I create a session, the token is not getting stored in the request header. I dont notice anywhere in this tutorial where you are explicitly storing the token to req.headers.authorization. please help!

[@bilkisuismail6096]

same here, please did you get a way around this?

[@sarcasticdna]

One good practice In Schema in usermodel add this field { ...something select:false } this will not return password unless we require by this method we can use less lodash to get it use .populate("password") in the end of query

[@TomDoesTech]

That's awesome! Thanks for the tip.

[@acdev972]

awesome. @TomDoesTech you should pin that comment. Thank you for the great tutorial

[@TomDoesTech]

@@acdev972 It doesn't work, or at least I can see it causing issues. If you do select false, it won't show up in the validation function.

[@acdev972]

@@TomDoesTech export async function validatePassword({ email, password }: { email: string; password: string }) { const user = await UserModel.findOne({ email }).populate("password"); if (!user) return false; const isValid = await user.comparePassword(password); if (!isValid) return false; return user.depopulate("password"); }

[@acdev972]

@@TomDoesTech the problem is that you need to "populate" the password in the findOne method from "mongoose" or it's undefined in the comparePassword instance method. see the fix above.

[@jritzeku]

Is it standard to have a Service layer ? In other mvc examples, I've usually seen all those functionalities from the service layers inside the controllers. Great tutorial btw! Will be watching the unit testing in express video next in your channel .

[@TomDoesTech]

I don't know if it's standard or now and I don't think it's useful to think about it like that. I think the question you should be asking is: "Does this make sense for my application and does it fit with the way I like to work?"

[@jritzeku]

@@TomDoesTech thanks !

[@adamsackfield589]

Hi loving the content. I’m having an error at the 51:00 mark with the user._id error is relating to can’t cast object to string.

[@thiagoroberto7891]

Man, me too. I found a comment that say that we can replace "return omit(user.toJSON(), 'password');" to "return omit(user.toObject(), 'password');" at user service