AI Prompts for Building REST APIs and Node.js Backend Architecture in 2026

I've used AI assistants to build Node.js backends since GPT-4 first became available, and the workflow has matured significantly. The shift from 'generate the code' to 'design the architecture and then generate' has been the key improvement. AI generates working code quickly but generates working-at-scale architecture less reliably without explicit scaffold prompts. These are the patterns I use for Express, Fastify, and Hono-based backends.

Middleware Architecture Prompts: Designing Express Middleware Chains

Express middleware order matters in ways that cause production bugs when wrong. The AI prompt that produces correct middleware architecture: 'I'm building an Express.js API with these requirements: [list: authentication type, rate limiting needs, logging requirements, body parsing needs, CORS requirements, error handling approach]. Design the middleware chain with: (1) exact middleware registration order with reasoning for each ordering decision, (2) any middleware that should be router-level vs application-level and why, (3) the error handling middleware and where it must sit in the chain, (4) any security headers middleware I should add (recommend specific packages). Show me the index.js/app.js setup with comments explaining each decision.' The ordering reasoning is the most valuable part — most Express tutorials show middleware order without explaining why. Understanding the order (body parser before route handlers, auth before route handlers, error middleware last with four parameters) helps you maintain the architecture correctly as the project grows.

For production-ready security, always add to this prompt: 'Also include helmet.js configuration for appropriate security headers and review my CORS configuration for the production domain [my domain]. What headers should I NOT set that helmet sets by default for this type of API?' Helmet's defaults aren't always right for every API type — some headers break specific client scenarios.

• Always ask for middleware ordering reasoning, not just the order itself

• Router-level vs app-level middleware: auth can be router-level (not all routes need it)

• Error middleware: must have 4 parameters (err, req, res, next) — explicit signature matters

• Add helmet.js to every Express API — ask about defaults to disable for your use case

• Rate limiting: express-rate-limit for simple cases, Redis-backed limiter for distributed deployments

• Request logging: pino-http for structured JSON logs, not morgan for production APIs

Database Query and ORM Prompts for Prisma and Drizzle ORM

Prisma and Drizzle ORM are the dominant TypeScript ORM choices in 2026, and AI handles both well with the right prompts. For Prisma query generation: 'Using Prisma with this schema [paste relevant models], write a query that [describe requirement]. Include: (1) the correct relation includes/selects for minimal over-fetching, (2) any indexes I should add to the schema for this query pattern, (3) whether this should use findUnique, findFirst, or findMany and why, (4) how this query should be handled in a transaction if it's part of a multi-step operation.' The 'minimal over-fetching' instruction is critical — AI defaults to including all fields and relations without this constraint, which produces N+1-style problems when the query is used in list views. For complex aggregations and reporting queries where Prisma's abstraction becomes awkward, add: 'If Prisma's query API doesn't handle this well, show me how to use $queryRaw with a parameterized SQL query instead.'

Drizzle ORM prompt variant: 'Write this query in Drizzle ORM. Use the query builder (db.select().from()) not raw SQL. Show me the resulting TypeScript type of the return value and note any type assertions needed.' Drizzle's type inference is extremely precise but sometimes confusing in complex joins — seeing the inferred return type prevents runtime type surprises.

• Prisma: specify 'minimal over-fetching' — AI defaults to including all relations

• Always ask which indexes to add alongside the query generation

• Multi-step operations: ask about transaction wrapping for all Prisma queries

• Prisma $queryRaw: escape hatch for complex aggregations Prisma can't express cleanly

• Drizzle: ask for the inferred return type — Drizzle's precision means surprises in complex joins

• Connection pooling: PgBouncer for Postgres, ask AI for correct Prisma connection pool config