Backend developer roadmap: what to learn and in what order
Backend work is the logic, data and APIs behind apps. Here is a clear order to learn it, with a project at every stage.
Backend development is building the part of an application that users do not see: servers, APIs, business logic, databases, authentication and integrations. This roadmap gives an order that builds each skill on the previous one.
Stage 1: foundations
- Programming basics and a first language (see the beginner roadmap).
- Git and GitHub.
- The command line and a Linux basics.
- How the web works: HTTP, DNS, status codes, headers, cookies. (Earlier articles in this series explain these.)
Stage 2: pick one backend language and framework
Choose one stack and learn it deeply. Any of these is a good career choice:
- JavaScript or TypeScript with Node.js (Express, Fastify, NestJS)
- Python (FastAPI, Django, Flask)
- Java or Kotlin (Spring Boot)
- C# (ASP.NET Core)
- Go (standard library, Gin, Echo)
- PHP (Laravel), Ruby (Rails)
The concepts transfer between them, so do not spend months choosing.
Stage 3: build APIs
- REST: resources, methods (GET, POST, PUT, PATCH, DELETE), status codes, JSON.
- Request validation and clear error responses.
- Pagination, filtering and sorting.
- API versioning and documentation (OpenAPI/Swagger).
- Awareness of GraphQL and gRPC for later.
Project: a to-do or notes API with full CRUD.
Stage 4: databases
- SQL and relational databases (PostgreSQL or MySQL): tables, keys, joins, indexes, transactions, normalisation.
- Using an ORM or query builder, and also writing raw SQL.
- Migrations to change the schema safely.
- Basics of a NoSQL store (document database, key-value) and when to use it.
- Redis for caching and simple data structures.
Project: a blog or shop API with users, posts/products and orders, stored in PostgreSQL.
Stage 5: authentication and authorization
- Password hashing with a modern algorithm (bcrypt, scrypt or Argon2). Never store plain passwords.
- Sessions vs tokens (JWT) and when each fits.
- OAuth 2.0 / OpenID Connect for "Sign in with ..."
- Authorization: roles, permissions and checking ownership of every resource.
- Basics of the common web vulnerabilities (see the web security series).
Project: add registration, login and role-based access to your API.
Stage 6: quality
- Testing: unit, integration and API tests, with a test database.
- Logging and error handling.
- Linting, formatting and type checking.
- Code review habits and clean code principles.
- Environment configuration with environment variables, never hard-coded secrets.
Stage 7: performance and scale
- Caching (HTTP caching, Redis), and when not to cache.
- Database indexing and reading query plans.
- Background jobs and queues (for email, image processing, reports).
- Rate limiting and protecting your API.
- Concurrency basics in your language.
- An introduction to system design (see the system design series).
Stage 8: deployment and operations
- Docker basics.
- CI/CD with GitHub Actions.
- Deploy to a VPS or a cloud platform, with HTTPS and a reverse proxy.
- Monitoring, logs and alerts.
- Backups and restore tests.
- Basics of cloud services: managed databases, object storage, serverless.
Project: deploy your API with a domain name, HTTPS, a database, automated tests on every push and a daily backup.
Stage 9: go deeper
Pick topics as needed: message brokers (Kafka, RabbitMQ), microservices vs monolith, event-driven design, search engines, observability, Kubernetes, advanced security.
How to learn it
- Build projects at each stage, ideally ones you will actually use.
- Read the official documentation.
- Read other people's open-source backends.
- Deploy early. Real hosting teaches things local development hides.
- Write about what you build. It clarifies your thinking and helps your portfolio.
What employers usually look for
- A solid grasp of one language and framework.
- SQL and database design.
- Building and securing APIs.
- Testing and Git habits.
- Basic deployment knowledge.
- Clear communication and the ability to learn.
Takeaway: learn the web basics, one language and framework, APIs, SQL, authentication, testing, then deployment. Build and deploy a project at every stage, and add depth only when you need it.
Programming roadmaps series, Part 1 (getting started): 3 of 5. Previous: Git and GitHub for beginners: a daily workflow that works.
