How to Build a API Backend with Replit

1// Prompt to type into Replit Agent:
2// Build a Node.js Express REST API with:
3// - Built-in PostgreSQL using Drizzle ORM
4// - Drizzle schema in shared/schema.ts:
5//   * api_keys: id serial pk, user_id text not null, key_hash text not null unique,
6//     name text not null, permissions text[] default ARRAY['read'],
7//     rate_limit integer default 100, last_used_at timestamp,
8//     is_active boolean default true, created_at timestamp default now()
9//   * resources: id serial pk, name text not null, description text,
10//     category text, metadata jsonb, created_by text not null,
11//     created_at timestamp default now(), updated_at timestamp default now()
12//   * request_logs: id serial pk, api_key_id integer references api_keys,
13//     method text, path text, status_code integer,
14//     response_time_ms integer, ip_address text, created_at timestamp default now()
15// - Three middleware: requestLogger, authenticateApiKey, rateLimit
16// - Routes: GET/POST /api/resources, GET/PUT/DELETE /api/resources/:id,
17//   POST /api/auth/register (generate API key), GET /api/health
18// - Pagination via ?page=1&limit=20, filtering via ?category=x, sorting via ?sort=name&order=asc
19// - Use Replit Auth for the API key management dashboard
20// - Return the raw API key once on creation, only store SHA-256 hash

1import crypto from 'crypto';
2import { db } from '../db.js';
3import { apiKeys, requestLogs } from '../../shared/schema.js';
4import { eq, and } from 'drizzle-orm';
5
6function hashKey(rawKey) {
7  return crypto.createHash('sha256').update(rawKey).digest('hex');
8}
9
10export async function authenticateApiKey(req, res, next) {
11  const authHeader = req.headers.authorization;
12  if (!authHeader || !authHeader.startsWith('Bearer ')) {
13    return res.status(401).json({ error: 'Missing or invalid Authorization header. Use: Bearer <api_key>' });
14  }
15
16  const rawKey = authHeader.slice(7);
17  const keyHash = hashKey(rawKey);
18
19  try {
20    const [apiKey] = await db
21      .select()
22      .from(apiKeys)
23      .where(and(eq(apiKeys.keyHash, keyHash), eq(apiKeys.isActive, true)))
24      .limit(1);
25
26    if (!apiKey) {
27      return res.status(401).json({ error: 'Invalid or revoked API key' });
28    }
29
30    // Update last_used_at asynchronously — don't block the request
31    db.update(apiKeys)
32      .set({ lastUsedAt: new Date() })
33      .where(eq(apiKeys.id, apiKey.id))
34      .catch(console.error);
35
36    req.apiKey = apiKey;
37    next();
38  } catch (err) {
39    res.status(500).json({ error: 'Authentication failed' });
40  }
41}

1import { db } from '../db.js';
2import { requestLogs } from '../../shared/schema.js';
3import { eq, gte, count } from 'drizzle-orm';
4
5export async function rateLimit(req, res, next) {
6  if (!req.apiKey) return next(); // skip if no key (unauthenticated routes)
7
8  const oneHourAgo = new Date(Date.now() - 60 * 60 * 1000);
9
10  try {
11    const [result] = await db
12      .select({ count: count() })
13      .from(requestLogs)
14      .where(
15        eq(requestLogs.apiKeyId, req.apiKey.id),
16        gte(requestLogs.createdAt, oneHourAgo)
17      );
18
19    const requestCount = Number(result.count);
20    const limit = req.apiKey.rateLimit;
21
22    if (requestCount >= limit) {
23      const retryAfter = 3600 - Math.floor((Date.now() - oneHourAgo.getTime()) / 1000);
24      res.set('Retry-After', String(retryAfter));
25      res.set('X-RateLimit-Limit', String(limit));
26      res.set('X-RateLimit-Remaining', '0');
27      return res.status(429).json({
28        error: `Rate limit exceeded. Limit: ${limit} requests/hour. Try again in ${retryAfter} seconds.`
29      });
30    }
31
32    res.set('X-RateLimit-Limit', String(limit));
33    res.set('X-RateLimit-Remaining', String(limit - requestCount - 1));
34    next();
35  } catch (err) {
36    next(); // fail open — don't block requests if rate limit check fails
37  }
38}

1import { db } from '../db.js';
2import { resources } from '../../shared/schema.js';
3import { eq, like, asc, desc, count } from 'drizzle-orm';
4
5export async function listResources(req, res) {
6  const page = Math.max(1, parseInt(req.query.page) || 1);
7  const limit = Math.min(100, Math.max(1, parseInt(req.query.limit) || 20));
8  const offset = (page - 1) * limit;
9  const category = req.query.category;
10  const search = req.query.search;
11  const sortField = ['name', 'created_at', 'category'].includes(req.query.sort)
12    ? req.query.sort : 'created_at';
13  const sortDir = req.query.order === 'asc' ? asc : desc;
14
15  try {
16    let query = db.select().from(resources);
17    let countQuery = db.select({ count: count() }).from(resources);
18
19    if (category) {
20      query = query.where(eq(resources.category, category));
21      countQuery = countQuery.where(eq(resources.category, category));
22    }
23
24    const [{ count: total }] = await countQuery;
25    const items = await query
26      .orderBy(sortDir(resources[sortField === 'created_at' ? 'createdAt' : sortField]))
27      .limit(limit)
28      .offset(offset);
29
30    res.json({
31      data: items,
32      pagination: {
33        page,
34        limit,
35        total: Number(total),
36        totalPages: Math.ceil(Number(total) / limit),
37        hasNext: page * limit < Number(total),
38      },
39    });
40  } catch (err) {
41    res.status(500).json({ error: 'Failed to fetch resources' });
42  }
43}

1// Test your API from the Replit Shell (these are server-side tests, not terminal commands):
2// Use the Webview tab or test from any HTTP client with your deployed URL
3
4// GET /api/health — should return 200 with status: 'ok'
5// Response: { "status": "ok", "uptime": 42.3, "version": "1.0.0" }
6
7// POST /api/auth/register — create your first API key
8// Body: { "name": "My App Key" }
9// Response: { "key": "abc123...", "message": "Save this key — it won't be shown again" }
10
11// GET /api/resources — use the key you just created
12// Header: Authorization: Bearer abc123...
13// Response: { "data": [], "pagination": { "total": 0, ... } }
14
15// Deploy: Click Deploy in the top-right → Autoscale → Deploy
16// Add Secrets in the Deployment panel (not workspace Secrets)
17// Your API gets a permanent URL like: https://your-app.repl.co