After 6 months running a Node.js/Express API in production, this post distills what actually matters: structuring routes properly for REST, validating input with Joi, JWT authentication, and managing versioning so you never have to break existing clients.