Backend Developer Roadmap

Module 1

Level up your Python with the patterns that matter for backend work — type safety, async programming, structured error handling, and clean project setup.

• Type HintsSelf-documenting code the editor checks
• Pydantic ModelsValidate data before it hurts you
• async/awaitWhy backend Python is concurrent now
• Custom ExceptionsErrors that carry context
• Structured LoggingLogs as JSON, queryable in production
• Project Setupvenv, pyproject.toml & dependency pinning
• Linting & Formattingruff and pre-commit so style stops being an argument

Project: Initialize the TaskForge project with a virtual environment, pyproject.toml, ruff for linting, and structured logging. Build a typed config layer with Pydantic that loads from .env and validates required values on startup.

Module 2

Before any framework, understand the protocol. Status codes, methods, headers, and content negotiation are the vocabulary every backend engineer is expected to know fluently.

• The Request/Response CycleWhat happens between curl and a server
• HTTP MethodsGET, POST, PUT, PATCH, DELETE — and which to use when
• Status Codes That Matter2xx, 4xx, 5xx — and the ones you actually need
• Headers & Content TypesJSON, auth, caching headers
• Idempotency & SafetyWhy retrying a POST is dangerous
• Cookies vs TokensTwo ways to keep state across requests

Project: Use curl and HTTPie to walk through every CRUD operation on a public API. Read each request and response — headers, status, body — and document what every field means.

Module 3

Build a working API from scratch. From a single endpoint to a structured app with validation, dependency injection, and auto-generated docs — all in FastAPI.

• Routes & Path OperationsGET, POST and the rest
• Path & Query ParamsTyped, validated, documented
• Request & Response ModelsLet Pydantic guard your API
• Dependency InjectionShare DB connections, auth and config
• Routers & Project LayoutSplitting a real app into files
• MiddlewareLogging, CORS, request IDs
• Background TasksOffloading work without blocking the response
• OpenAPI & Auto DocsSwagger UI for free

Project: Build the TaskForge API skeleton: CRUD endpoints for /tasks with Pydantic request/response models, dependency-injected config, middleware for request IDs and CORS, and interactive Swagger docs at /docs.

Module 4

Design a real schema, write queries that perform, and understand how Postgres actually executes them. The database is the floor of every backend system — get it right.

• Schema DesignTables, relationships and when to normalize
• Constraints & KeysPrimary, foreign, unique, NOT NULL
• SELECTs Beyond Hello WorldWHERE, ORDER BY, LIMIT
• JoinsINNER, LEFT, RIGHT — and when each is right
• Aggregates & GROUP BYCOUNT, SUM, AVG with grouping
• Window FunctionsROW_NUMBER and friends
• IndexesWhy your query is slow and how to fix it
• EXPLAIN & Query PlansReading what Postgres actually does
• Transactions & IsolationACID for backend engineers

Project: Design the TaskForge schema in raw SQL: users, teams, tasks, comments. Add proper foreign keys, NOT NULL constraints, and indexes on filterable columns. Write queries for task listing with team joins and overdue task aggregation.

Module 5

Most production Python APIs use an ORM. Learn SQLAlchemy 2.0 the modern way — typed models, async sessions, and Alembic migrations — without losing the SQL fluency you just built.

• Models & MappingsSQLAlchemy 2.0 typed style
• Sessions & The Unit of WorkWhen changes actually hit the database
• RelationshipsOne-to-many, many-to-many, lazy vs eager
• Queryingselect(), where(), join() in modern style
• Avoiding the N+1selectinload, joinedload and the EXPLAIN proof
• Async SQLAlchemyAsync sessions in FastAPI
• Alembic MigrationsSchema changes without downtime

Project: Replace TaskForge's raw SQL with SQLAlchemy 2.0 typed models for every table. Wire the async engine, add a session-per-request dependency, and set up Alembic to manage the schema as code.

Module 6

Connect FastAPI to managed Postgres. Use Supabase for auth and storage so you ship faster, and let Row-Level Security enforce permissions in the database itself — not just in code.

• Supabase SetupConnecting FastAPI to a managed Postgres
• Verifying Supabase JWTsTrust tokens, but verify
• Row-Level SecurityLet the database enforce permissions
• Writing RLS PoliciesUSING and WITH CHECK in practice
• Supabase StorageBuckets, signed URLs and uploads

Project: Migrate TaskForge to Supabase Postgres. Verify Supabase JWTs in FastAPI middleware. Add RLS policies so users only see tasks in their team. Build /tasks/{id}/attachments using Supabase Storage with signed download URLs.

Module 7

Good API design isn't subjective — there are proven patterns for URLs, responses, errors, and pagination. Learn the conventions that make APIs intuitive and professional.

• URL DesignNouns, nesting and the patterns everyone expects
• Choosing Status Codes200 vs 201 vs 204 vs 400 vs 422
• PaginationOffset vs cursor and when each wins
• Filtering & SortingQuery param conventions that scale
• Error ResponsesRFC 7807 problem details
• OpenAPI in PracticeSpecs that double as docs
• API DocumentationExamples, recipes and what good docs include

Project: Refactor TaskForge to follow REST conventions: cursor-based pagination on /tasks, filters and sort (?status=open&assignee=me&sort=-created_at), RFC 7807 Problem Details on errors, and a clean OpenAPI spec.

Module 8

Secure your API with patterns real teams use. Understand JWTs from the inside, implement role-based access control, and protect against the attacks that actually happen.

• Password Hashingbcrypt, argon2 and what never to do
• JWT Deep DiveHeader, payload, signature, claims
• Access vs Refresh TokensThe pair that keeps users logged in safely
• Login & Registration FlowsFrom request to issued token
• Password ResetSingle-use tokens, secure delivery
• Auth Dependencies in FastAPIcurrent_user injected on every route
• Role-Based Access ControlRoles, scopes, resource ownership
• OWASP Top 10 for APIsThe attacks you need to know exist
• Rate LimitingStop runaway clients before they hurt you

Project: Add auth to TaskForge: signup/login with access + refresh tokens, password reset flow with single-use tokens, a current-user dependency, role-based permissions (owner/admin/member per team), and per-IP rate limiting.

Module 9

Real APIs don't do everything in the request cycle. Email, PDFs, AI calls, webhooks — push them to a queue and let workers handle them. Understand queues deeply and you understand backend.

• Why You Need a QueueLatency, retries, reliability
• Producers, Brokers, WorkersThe mental model of every queue system
• Picking a QueueCelery vs RQ vs Arq vs SQS
• Writing JobsIdempotent, retriable, observable
• Scheduled JobsCron-style and delay-style scheduling
• Retries & BackoffWhy exponential, why jitter
• Dead Letter QueuesWhere failures go to be debugged

Project: Add a Redis-backed queue (Arq or RQ) to TaskForge. Move email sending to a worker. Add a scheduled job that emails overdue task summaries every morning. Build a dead-letter queue for failed jobs and a retry-with-backoff policy.

Module 10

Caching is a small change with a huge effect — when you do it right. Learn the layers (HTTP, Redis, query plan), the invalidation patterns, and how to find the real bottleneck before optimizing the wrong thing.

• Where to CacheApp, HTTP, CDN, database — and why
• Redis as a CacheKeys, TTL, eviction policies
• Cache-Aside PatternThe default for most APIs
• Cache InvalidationThe hard problem, made tractable
• HTTP CachingETags, Cache-Control, conditional requests
• Finding BottlenecksProfiling, EXPLAIN, py-spy
• Connection PoolingWhy your DB throws errors under load
• Load Testing with k6Numbers before you optimize

Project: Add Redis caching to TaskForge: cache the team task list with automatic invalidation on writes, ETag GET /tasks/{id} so clients skip unchanged responses, and run a load test (locust or k6) comparing cached vs uncached p95 latency.

Module 11

A backend without tests is a backend you'll be afraid to change. Learn the modern Python testing stack — pytest, fixtures, factories, and FastAPI's TestClient — and the right ratio of unit, integration, and end-to-end tests.

• The Testing PyramidUnit, integration, e2e — how much of each
• pytest BasicsTests, assertions, fixtures
• FixturesSetup and teardown done right
• Test Data with factory_boyRealistic objects without copy-paste
• FastAPI TestClientHitting your routes from a test
• Database TestsTransactional rollback for fast, isolated tests
• Mocking External ServicesDon't hit OpenAI from your unit tests
• Tests in CIGitHub Actions running the whole suite on every PR

Project: Build a pytest suite for TaskForge: unit tests for utilities, integration tests for each endpoint using TestClient against a real test database (with transactional rollback), factory_boy for test data, and run everything in CI on every PR.

Module 12

When something breaks at 3am, observability is the difference between a quick fix and a postmortem. Learn the modern stack — structured logs, OpenTelemetry traces, Prometheus metrics — and what to instrument first.

• Why ObservabilityLogs, metrics, traces — the three signals
• Structured LoggingJSON logs you can actually query
• Correlation IDsTying every log to a request
• Metrics with PrometheusCounters, gauges, histograms
• OpenTelemetry TracingSpans across services
• What to Alert OnSymptom-based alerts vs cause-based noise

Project: Instrument TaskForge: structured JSON logs with trace IDs on every request, OpenTelemetry traces shipped to a local Jaeger, /metrics endpoint with request count, latency histogram, and DB query time. Build a Grafana dashboard showing the RED method.

Module 13

Code that runs only on your laptop isn't a backend. Learn to package, configure, and deploy a Python service the way modern teams do — Docker, env config, secrets, zero-downtime deploys.

• Dockerizing FastAPIMulti-stage build, slim image, non-root user
• 12-Factor ConfigurationWhy config belongs in env vars
• Secrets ManagementWhere API keys actually go
• Health & Readiness EndpointsWhat load balancers and Kubernetes need
• Database Migrations on DeployRunning Alembic safely in production
• Zero-Downtime DeploysBlue/green, rolling, and what could go wrong
• CI/CD for Python APIsTest, build, deploy on merge

Project: Containerize TaskForge with a multi-stage Dockerfile, externalize all config via env vars validated by Pydantic, store secrets in the cloud's secret manager, and ship a CI/CD pipeline that runs tests and deploys on merge to main.

Module 14

AI features can transform a CRUD API into a product. Learn to integrate the OpenAI SDK, stream responses, manage cost and rate limits, and build features that fail gracefully.

• OpenAI Python SDKChat completions, system prompts, models
• Streaming with SSEServer-Sent Events from FastAPI
• Structured OutputsJSON mode and Pydantic-validated responses
• Embeddings & pgvectorSemantic search inside Postgres
• Retries, Timeouts & BackoffModels go down — your API shouldn't
• Cost Tracking & BudgetsPer-user spend limits in code

Project: Add three AI features to TaskForge: (1) POST /tasks/{id}/summarize that streams a token-by-token summary, (2) POST /tasks/suggest-priority that returns a structured JSON suggestion, (3) POST /tasks/search using embeddings + pgvector. All with retries, cost tracking, and a per-user budget.