Mobile clients are hostile networks
Assume tokens leak, clients are outdated, and attackers will replay requests. Design the API as if the mobile app is untrusted — because distribution channels and device compromise make that the safe default.
Security is not a middleware plugin you add at the end. It is how you model auth, authorization, and validation from day one.
Baseline controls
- Short-lived access tokens with refresh rotation
- Server-side authorization on every resource (never trust client roles alone)
- Input validation and careful output shaping
- Rate limiting per user and per IP
- Structured audit logs for sensitive actions
- TLS everywhere; no sensitive data in URLs
Add device/session revocation for lost phones and stolen refresh tokens.
Versioning without pain
Prefer additive changes. When a breaking change is required, version explicitly (/v2) and communicate deprecation windows that respect slow app-store update cycles.
Contract tests between app and API catch drift early. Document required headers, error shapes, and pagination once — and keep them stable.
Payload discipline for flaky networks
Mobile networks drop. Support pagination, sparse fieldsets where useful, and idempotent writes for payments and bookings. Return actionable error codes the app can map to UI, not opaque 500s.
Compress wisely and avoid oversized JSON blobs for lists that should be paged.
Delivery as one surface
XYRONEXT builds mobile apps and the Node APIs behind them as one delivery surface — not two disconnected vendors. Pair with custom software when the API also serves web and partner clients.