API Starter — Express + TypeScript

What it does & who it's for

API Starter is the Express + TypeScript foundation you keep rebuilding on every backend project, done properly once: strict-mode TypeScript across 22 source files, zod validation on every input (env config, bodies, queries, params), JWT authentication with access + refresh tokens, a typed error envelope with stable machine-readable codes, per-IP rate limiting, structured JSON logging with request ids, and a clean layered architecture (routes → controllers → services). One example resource — projects CRUD with pagination, filtering, sorting and ownership scoping — is wired end to end so every pattern is demonstrated in a real request path, not a comment. The auth is the part most starters get wrong, and the part this one takes seriously. Refresh tokens are single-use: every refresh consumes the presented token server-side and issues a new pair, and replaying an already-consumed token is treated as theft — every session for that user is revoked. Passwords are bcrypt-hashed (cost 12, configurable), and login burns identical hash time for unknown emails and wrong passwords so response timing never leaks who has an account. Clients drive the whole flow off stable error codes like TOKEN_EXPIRED — never string-matching on messages. It runs with zero external services: typed in-memory stores stand in for persistence, so npm install to an authenticated, rate-limited API is about two minutes. The stores are deliberately shaped like tables, and README-setup.md maps the exact seams — two service files — where Postgres/Prisma, Mongo or anything else plugs in while controllers, routes, schemas and middleware stay untouched. Adding your own resource is four files copied from the projects example plus one mount line. Wiring this yourself — refresh rotation with reuse detection, a central error handler that never leaks internals, env validation that fails loudly at boot, graceful SIGTERM draining — is comfortably a week of careful work, and every shortcut becomes a production incident later. Try the live demo first: it is a static docs preview generated from the real shipped source, showing every endpoint, the auth flow and actual code from the package before you pay.

Version history

1. v1.0Latest6 Aug 2026

Licence & terms

These terms are snapshotted at purchase — what you see here is what applies to your order.

Reviews