Backend Developer
Become employable as a junior backend developer, able to design and ship a production REST API with a database, authentication and tests.
This is a starting point — make it yours
Use this goal to build your own roadmap — tailored to you and starting fresh.
Language and fundamentals
One language, properly, before any framework.
Get fluent in one language~20h
Python is the gentlest start. Data structures, functions, classes, error handling, modules, virtual environments.
Done when: you can write a 200-line script without looking up syntax.
Build a command-line tool~10h
Something you'd actually use — a file organiser, a habit tracker, an expense splitter. Read and write files, handle bad input.
Done when: it fails helpfully rather than with a traceback.
Learn how HTTP actually works~6h
Methods, status codes, headers, request and response bodies, cookies. Inspect real traffic in the browser's network tab.
Done when: you can explain the difference between 401 and 403, and between PUT and PATCH.
Databases
Learn SQL before an ORM, so you know what the ORM is doing.
Write raw SQL against a real database~14h
PostgreSQL. SELECT, JOIN, GROUP BY, indexes, transactions. Design a schema with foreign keys and constraints.
Done when: you can write a three-table join and explain why an index helps.
Use an ORM and understand its cost~10h
SQLAlchemy. Models, relationships, sessions — and the N+1 query problem.
Done when: you can spot an N+1 in your own code and fix it with eager loading.
Learn schema migrations~6h
Alembic. Making a schema change without dropping the database, and reversing one.
Done when: you can add a non-nullable column to a table that already has rows.
Build the API
The core of the job.
Build a REST API with full CRUD~16h
FastAPI or Django REST Framework. Proper status codes, request validation, consistent error shapes.
Done when: every endpoint validates input and returns the right code on failure.
Add authentication and authorisation~14h
Password hashing, sessions or JWTs, and the difference between the two. Then authorisation: can this user touch this record?
Done when: a user provably cannot read another user's data.
Write tests that would catch a real regression~12h
pytest. Test the ownership rules and the error paths, not just the happy path.
Done when: deliberately breaking an auth check makes a test fail.
Production
What separates a tutorial project from a deployable one.
Containerise it with Docker~8h
A Dockerfile and docker-compose with your database.
Done when:
docker compose upstarts the whole stack cleanly on a fresh machine.Deploy it somewhere public~8h
Render, Fly.io or Railway, with a managed database and environment variables for secrets.
Done when: the API is reachable over HTTPS and no secret is in the repo.
Add logging and a health check~6h
Structured logs, a
/healthendpoint, and an honest error response that doesn't leak internals.Done when: you can diagnose a failed request from the logs alone.