Variables, control flow, functions, error handling, and the type system of one language you commit to first.

Compare the four most common backend languages and their ecosystems, then go deep on one instead of skimming all.

Install, pin, and audit dependencies with npm, pip, Go modules, or Maven so builds stay reproducible.

How your language handles non-blocking I/O, threads, or goroutines, since backends live or die on concurrency.

Move around the filesystem, pipe commands, edit files, and chain grep, sed, and awk to inspect logs and data.

How the OS schedules processes, why signals matter for graceful shutdown, and how apps bind to ports.

Users, groups, file permissions, and environment variables that decide what your service can and cannot do.

Commits, branches, merges, and rebases, plus resolving the conflicts that inevitably show up.

Feature branches, code review, and a workflow like trunk-based or GitHub Flow that fits your team.

Mark releases with tags and communicate change scope through major, minor, and patch versions.

Methods, status codes, headers, cookies, and how TLS secures the connection your API rides on.

How a request travels from browser to server through DNS resolution, load balancers, and reverse proxies.

Parsing, routing, middleware, handler, and response, so you know exactly where your code fits.

SELECT, JOIN, GROUP BY, subqueries, and aggregation to read and shape data from many tables.

Model entities and relationships, apply normal forms, and know when denormalizing is the right call.

How indexes speed reads, when they hurt writes, and how to read an EXPLAIN plan to fix slow queries.

Atomicity, isolation levels, and locking so concurrent writes stay correct under load.

Schema-flexible JSON documents in stores like MongoDB, and the modeling tradeoffs versus relational tables.

Redis for key-value speed and Cassandra-style wide-column stores for write-heavy, partitioned data.

Match access patterns, consistency needs, and scale to the right data store instead of following hype.

Model nouns as resources, map CRUD to HTTP methods, and return the status codes clients expect.

Express, Fastify, FastAPI, Gin, or Spring to handle routing, middleware, and request parsing for you.

Keep large collections usable and evolve endpoints without breaking existing consumers.

Describe endpoints in an OpenAPI spec so clients, tests, and docs stay in sync with reality.

Let clients ask for exactly the fields they need, and understand the N+1 problem you must solve.

Strongly typed, high-performance RPC over HTTP/2 for internal service-to-service communication.

Weigh REST, GraphQL, and gRPC against your clients, latency budget, and team familiarity.

Cookie-based sessions versus stateless JWTs, and the tradeoffs each makes for scale and revocation.

Delegate identity to providers and understand the authorization code flow behind social login.

Salt and hash with bcrypt or argon2, and never store or log credentials in plaintext.

Model permissions with RBAC or ABAC so authorization scales past a single admin flag.

Prisma, SQLAlchemy, GORM, or Hibernate map rows to objects, but know when raw SQL is clearer.

Version schema changes in code so every environment applies the same ordered, reversible steps.

Reuse database connections to avoid exhausting the server under concurrent request load.

Cache expensive computations and hot reads in process or in Redis to cut latency and database load.

TTLs, write-through, and cache-aside patterns to stop serving data that has quietly gone stale.

Use cache-control headers and a CDN to serve static and cacheable responses from the edge.

Offload email, image processing, and reports to workers pulling from a queue like RabbitMQ or SQS.

Publish events to durable, replayable logs so many consumers can react without tight coupling.

At-least-once delivery means duplicates happen, so make consumers idempotent to stay correct.

Injection, broken access control, and the other most common web vulnerabilities you must design against.

Validate and sanitize every input at the boundary to block injection and malformed data.

Protect endpoints from abuse and runaway clients with per-user and per-IP limits.

Keep keys out of source control, rotate them, and enforce TLS everywhere in transit.

Test pure functions and business logic in isolation for fast, reliable feedback on every change.

Exercise your code against a real database and dependencies to catch wiring bugs unit tests miss.

Verify that services honor their API contracts and that critical flows work across the whole stack.

Write Dockerfiles, build small images, and run your backend in a container identical across environments.

Automate build, test, and deploy so every merge reaches production through a repeatable pipeline.

Drive config through environment variables and keep dev, staging, and prod cleanly separated.

Emit machine-parseable logs with correlation IDs so you can trace one request across services.

Track latency, error rate, and throughput with Prometheus and Grafana to spot trouble early.

Follow a request through many services with OpenTelemetry to find the slow hop in a call chain.

Run stateless instances behind a load balancer so you can add capacity by adding machines.

Read replicas, sharding, and partitioning to push the database past a single-node ceiling.

Split services along business capabilities, and respect the operational cost that distribution adds.

Timeouts, retries with backoff, and circuit breakers so one failing dependency does not take everything down.