Kotlin For Backend APIS

Backend development in Kotlin is no longer an afterthought. Ktor — JetBrains' Kotlin-first HTTP framework — is now used in production at companies building high-throughput APIs on the JVM. It runs on coroutines, imposes no annotation processing, and puts every configuration decision in code. If you know Kotlin, Ktor is the most direct path from language knowledge to a live, scalable API.

Kotlin for Backend APIs takes you all the way there: from a single GET /health route to a fully deployed, JWT-authenticated, rate-limited, Dockerised API running live on Railway.

WHAT YOU WILL BUILD

KontactBook's backend starts as the simplest possible Ktor application and gains a new production feature in every chapter: contact CRUD endpoints, kotlinx.serialization for type-safe JSON, a PostgreSQL database via Exposed and HikariCP, Flyway schema migrations, a repository pattern with a service layer and sealed result types, JWT authentication with bcrypt password hashing, structured error handling with RFC 7807 problem details, input sanitization against SQL injection and XSS, a full integration test suite with an in-memory test engine, Prometheus metrics, sliding-window rate limiting, a Docker container, and a Railway deployment with CI/CD.

WHAT YOU WILL LEARN

The first four chapters establish the Ktor foundation. You will learn how the plugin architecture works, how the routing DSL composes nested routes and HTTP method handlers, how ContentNegotiation wires kotlinx.serialization into the request/response pipeline, and how Ktor's in-memory test engine lets you write HTTP-level integration tests without a running server.

Chapters 5 and 6 introduce the data layer: Exposed's DSL API for type-safe SQL queries, PostgreSQL-specific features including JSONB and full-text search, and Flyway for version-controlled schema migrations that let the database evolve without data loss.

Chapter 7 builds the architecture: a ContactRepository that wraps Exposed, a service layer that coordinates repositories within a shared transaction, and the sealed class result types that make error propagation explicit across all layers.

Chapters 8 through 10 add security: JWT token generation and verification, bcrypt password hashing, global error handling middleware, structured logging with SLF4J and Logback, parameterised queries that prevent SQL injection, security headers, and rate limiting with a sliding window algorithm.

Chapter 11 builds the test suite: unit tests for the service layer with fake repositories, integration tests against a real PostgreSQL instance using Testcontainers, and HTTP-level tests with Ktor's testApplication engine.

Chapters 12 through 15 complete the production readiness checklist: Prometheus metrics with Micrometer, Docker packaging with a multistage build, SIGTERM-safe graceful shutdown via HikariCP lifecycle events, and a complete Railway deployment with environment variable management and CI/CD via GitHub Actions.