The Ultimate guide to Building Blazing Fast APIs

// Inefficient: Fetching all fields
const products = await prisma.product.findMany();

// Efficient: SGO with Prisma select
const products = await prisma.product.findMany({
  select: {
    id: true,
    name: true,
    imageUrl: true,
    slug: true
    // Only fields needed for homepage list
  }
});

// API endpoint with field selection parameter
app.get('/api/products', async (req, res) => {
  try {
    const { fields } = req.query;
    
    let selectFields = {
      id: true,
      name: true,
      imageUrl: true,
      slug: true
    };
    
    // Allow client to specify additional fields
    if (fields) {
      const requestedFields = fields.split(',');
      requestedFields.forEach(field => {
        if (['description', 'price', 'category'].includes(field)) {
          selectFields[field] = true;
        }
      });
    }
    
    const products = await prisma.product.findMany({
      select: selectFields
    });
    
    res.json({ data: products });
  } catch (error) {
    res.status(500).json({ error: 'Fetch failed' });
  }
});

// Usage: /api/products?fields=price,category

// Prisma schema for API key management
model ApiKey {
  id        String   @id @default(cuid())
  key       String   @unique
  name      String
  userId    String
  user      User     @relation(fields: [userId], references: [id])
  isActive  Boolean  @default(true)
  rateLimit Int      @default(1000) // requests per hour
  usageCount Int     @default(0)
  lastUsed  DateTime?
  createdAt DateTime @default(now())
  expiresAt DateTime?
}

// Middleware for API key validation
const validateApiKey = async (req, res, next) => {
  try {
    const apiKey = req.headers['x-api-key'];
    
    if (!apiKey) {
      return res.status(401).json({ 
        error: 'API key required',
        message: 'Include X-API-Key header with your request'
      });
    }
    
    const keyRecord = await prisma.apiKey.findUnique({
      where: { key: apiKey },
      include: { user: true }
    });
    
    if (!keyRecord || !keyRecord.isActive) {
      return res.status(401).json({ 
        error: 'Invalid or inactive API key' 
      });
    }
    
    // Check expiration
    if (keyRecord.expiresAt && keyRecord.expiresAt < new Date()) {
      return res.status(401).json({ 
        error: 'API key has expired' 
      });
    }
    
    // Rate limiting check
    const oneHourAgo = new Date(Date.now() - 60 * 60 * 1000);
    const recentUsage = await prisma.apiKey.findFirst({
      where: {
        id: keyRecord.id,
        lastUsed: { gte: oneHourAgo }
      }
    });
    
    if (recentUsage && recentUsage.usageCount >= keyRecord.rateLimit) {
      return res.status(429).json({ 
        error: 'Rate limit exceeded',
        resetTime: new Date(Date.now() + 60 * 60 * 1000)
      });
    }
    
    // Update usage tracking
    await prisma.apiKey.update({
      where: { id: keyRecord.id },
      data: {
        usageCount: { increment: 1 },
        lastUsed: new Date()
      }
    });
    
    req.user = keyRecord.user;
    req.apiKey = keyRecord;
    next();
  } catch (error) {
    res.status(500).json({ error: 'Authentication failed' });
  }
};

// Protected endpoint implementation
app.get('/api/products', validateApiKey, async (req, res) => {
  try {
    const products = await prisma.product.findMany({
      where: { deletedAt: null },
      select: {
        id: true,
        name: true,
        price: true,
        category: true
      }
    });
    
    res.json({ 
      data: products,
      meta: {
        apiKeyUsage: req.apiKey.usageCount,
        rateLimit: req.apiKey.rateLimit
      }
    });
  } catch (error) {
    res.status(500).json({ error: 'Failed to fetch products' });
  }
});