Backend Developer project
Build an authentication API with refresh tokens
A signup/login API with real password hashing and token rotation, not a tutorial's plaintext-and-JWT shortcut.
The brief
Build a REST API with signup, login, token refresh, and a protected /me route. Hash passwords with bcrypt or argon2, issue a short-lived access token and a longer-lived refresh token, rotate the refresh token on every use, and rate-limit the login endpoint. No frontend required — a documented set of curl or Postman requests is the interface.
Suggested stack
What you hand in
- A public GitHub repository with the running API and a README
- A Postman collection or curl examples covering signup, login, refresh, and the protected route
- A short section in the README explaining the token strategy and why refresh tokens are rotated
Grading happens against the rubric below, so read it before you start — not after.
How this is graded
Published in advance and weighted out of 100. Nothing here is a surprise.
Passwords are hashed with a proper algorithm (bcrypt/argon2/scrypt) and a per-user salt, never stored or logged in plaintext. Credentials never appear in error messages.
Access tokens are short-lived, refresh tokens are longer-lived and rotated on each use (the old one is invalidated), and expired or reused tokens are rejected with a clear 401.
Bad input returns 400 with a field-level message, not a 500. Duplicate signups and wrong passwords return distinct, non-leaking error codes.
Routes follow REST conventions, status codes match outcomes, and the protected route genuinely rejects requests without a valid token.
No console errors or crashes, no broken layout, no leftover placeholder text or commented-out code.
Why this project is worth your weekend
- Auth is on the critical path of nearly every real backend job's first assigned ticket.
- Token storage and rotation is one of the first things a backend interviewer asks about, so having built it beats having read about it.
- It is the fastest place for a candidate to demonstrate they take security seriously by default, not as an afterthought.
Where people lose points
- Storing passwords with a weak or missing hash (plaintext, unsalted MD5/SHA1) instead of bcrypt or argon2.
- Returning a generic 500 for validation failures instead of a 400 with a specific field-level message.
- Issuing a refresh token with no expiry or rotation, so a single stolen token stays valid forever.
Other Backend Developer projects
Two or three of these turn an empty resume into a portfolio.
Built it? Get it scored against this rubric.
Submit your work and get a score on every criterion above, written feedback, and three resume bullets you can use straight away.