Node.js / Express / JWT
Meetup REST API
Learning what happens between sending a request and getting a response.
A course project built with AI assistance, then explored through Thunder Client in VS Code. The API stores meetups, registers users, hashes passwords, and checks a signed token before allowing changes.
Source & local setup ↗Follow a request
Illustrative examples · no requests are sent
Request
POST /meetups
Content-Type: application/json
Authorization: Bearer <valid token>
{
"title": "Node.js study group",
"summary": "Practicing REST requests and authentication.",
"address": "Example Community Room"
}Response
201 Created
{
"id": 1,
"title": "Node.js study group",
"summary": "Practicing REST requests and authentication.",
"address": "Example Community Room"
}A valid request becomes a saved meetup
The JWT passes authentication. All three meetup fields pass validation, so the server assigns a numeric ID, writes the record to meetups.json, and returns it.
Six routes, two levels of access
Anyone can read meetups or create an account. Creating, editing, and deleting meetups requires a valid JWT from login.
| Method | Route | Access | Purpose |
|---|---|---|---|
| POST | /signup | Public | Create an account |
| POST | /login | Public | Verify credentials; issue a JWT |
| GET | /meetups | Public | Read saved meetups |
| POST | /meetups | JWT required | Create a meetup |
| PATCH | /meetups/:id | JWT required | Update supplied fields |
| DELETE | /meetups/:id | JWT required | Remove a meetup |
What I practiced
- Turning a plain-English brief into routes, then understanding the generated code.
- Separating JSON parsing from validation: readable JSON can still contain invalid meetup data.
- Using middleware to check a JWT before a protected handler runs.
- Testing failure cases as well as successful requests in Thunder Client.
What the tests showed
The September 17, 2026 Thunder Client report recorded passing signup, login, meetup CRUD, validation, and missing/invalid-token checks. Records survived a server restart. Password storage was inspected for salts and hashes rather than plaintext.
The token declares a one-hour lifetime; actual expiration was not exercised in that report.
A local learning project
The API runs locally with JSON files, not a production database. Any authenticated account can modify any meetup. Rate limiting, account recovery, and token revocation are not implemented. Several handlers still return errors directly, so fully centralized error handling remains a next step in the saved course version.
The walkthrough above contains illustrative sample exchanges. It does not send requests, create accounts, or store visitor data. To try the actual API, use the source repository’s setup instructions.