Startups & founders
A production-ready backend for your MVP or your next stage, built to grow with the product instead of being rewritten when it takes off.
$ cat ~/services
Backend systems, built & maintained.
For startups, established companies, agencies, and solo builders who need a backend that holds up in production. I build new backends, fix and extend existing ones, and keep them running.
- Django
- DRF
- FastAPI
- PostgreSQL
- Redis
- Celery
- Stripe
- Docker
- GitHub Actions
01
Who I work with
Companies & product teams
Extra backend capacity without a full-time hire. I work in your repo, follow your conventions, go through your code review, and ship.
Agencies
Backend work for your client projects: APIs, integrations, and deployments, delivered with docs your team can hand over.
Solo builders & vibe coders
Building with AI tools? Keep moving fast on the frontend and let a professional handle the part that holds your users' data.
Read this first02
What's included
An API built around your product
Custom REST APIs in Django, DRF, or FastAPI, designed around your data and your users. Multi-tenant setups where each organization only sees its own data, with roles and permissions to match.
Login and accounts done right
Sign-up, login, Google sign-in, and sessions that stay secure. Tokens rotate on refresh, stolen ones get caught when reused, and every OAuth login is properly verified.
Payments that add up
Stripe billing wired in properly. A webhook Stripe retries won't charge anyone twice, and balances stay correct even when requests land at the same moment.
Slow work off the main path
Reports, file processing, emails, and third-party calls run as background jobs, so your app stays fast. Users see live progress instead of a spinner that might never finish.
A database that fits the data
A PostgreSQL schema designed for how your product actually reads and writes, with versioned migrations so every schema change is reviewed and reversible.
Docs your team can use
Auto-generated OpenAPI / Swagger docs that update with the code. Your frontend team, partners, or AI coding tools can integrate without guessing.
Deployed, not handed off
Automated tests, CI/CD with GitHub Actions, Docker, and separate staging and production environments. You get a running system, not a zip file.
Built to hold up under load
Caching and rate limiting with Redis, so traffic spikes and abusive clients don't take the app down.
After launch
Most backends don't fail on launch day. They fail six months later, when nobody's watching. The ongoing plan covers continuous updates, bug fixes, and monitoring for a flat monthly fee, so you're never billed by the hour to keep your own product alive.
03
Existing projects
Already have a backend? I'll work on it.
You don't need to start from scratch. Whether a person, an agency, or an AI wrote it, I can step into your codebase, get up to speed, and start fixing things. One-off fixes or ongoing work, both are fine.
- Bug fixes, from small annoyances to production fires
- New features added to your current codebase
- Security fixes and hardening for AI-built backends
- Slow endpoints and database queries made fast
- Tests and CI added to code that has none
- Framework, Python, and dependency upgrades
- Taking over from a previous developer or agency
- API docs for an API that never had any
04
For vibe coders
Vibe-code your frontend. Don't vibe-code your backend.
AI tools are great for UIs and prototypes. The backend is different: it holds your users' data and your money, and its mistakes stay quiet. Everything works in the demo, until someone finds the hole.
Wide-open security holes
API keys shipped in the frontend, endpoints that skip permission checks, logins with no rate limit. Bots scan the internet for these around the clock. You don't need to be famous to get hit by a script kiddie.
Legal trouble
If your users' personal data leaks, privacy laws like GDPR and CCPA can mean breach notifications, fines, and lawsuits. "The AI wrote it" isn't a defense.
Bugs that cost real money
Webhooks that aren't verified, payments that get processed twice, upgrades anyone can unlock for free. These pass every demo, then show up on your Stripe dashboard.
Code nobody understands
When it breaks at 2am, the tool that generated it can't tell you why, and each new prompt risks breaking something else.
The setup that works
Keep building your frontend with whatever AI tools you like. I build the backend properly, and every endpoint ships with clear, detailed OpenAPI / Swagger docs: what it does, what it expects, every validation rule, what it returns, and every error it can throw.
FastAPI and DRF generate the docs page straight from the code, docstrings included, so it never drifts out of date. Copy the docs into your AI tool and it can connect your frontend to the backend without guessing. You move fast on the parts users see, and the parts they don't are done right.
Your App API1.0.0OAS 3.0
/api/schema/auth
Registration, email verification, and session managementPOST/api/auth/register/Register a new user account.
Register a new user account.
Endpoint: POST api/auth/register/
Authentication: None required (AllowAny)
Throttle: 5 requests per minute per IP (ScopedRateThrottle, scope register)
Request Body (JSON)
| Field | Type | Required | Description |
|---|---|---|---|
| string | Yes | User's email address (case-insensitive, must be unique) | |
| first_name | string | Yes | User's first name |
| last_name | string | Yes | User's last name |
| password | string | Yes | Account password (write-only) |
| confirm_password | string | Yes | Must match password (write-only) |
Field Validation Rules
- Stripped of whitespace and lowercased before storage.
- Must be unique. Raises 400 if an account with this email already exists.
first_name / last_name
- Minimum 2 characters (after stripping whitespace).
- Only letters (including accented), spaces, hyphens, and apostrophes are allowed.
password
- Minimum 8 characters, maximum 128 characters.
- Must contain at least one uppercase letter, one lowercase letter, and one digit.
- Must contain at least one special character.
- Multiple password errors are returned together as a list.
confirm_password
- Must exactly match password.
- Not stored. Stripped from validated data before user creation.
Responses
201 Created
Registration successful. User is created with is_verified=False. A 6-digit verification code is hashed and stored, and the raw code is sent to the user's email. The code expires in 15 minutes.
{
"email": "jane@example.com",
"first_name": "Jane",
"last_name": "Doe",
"is_verified": false
}400 Bad Request
One or more validation errors occurred.
Single field error:
{
"email": ["An account with this email already exists."]
}Password mismatch:
{
"confirm_password": ["Passwords do not match."]
}Multiple password errors:
{
"password": [
"Password must contain at least one uppercase letter.",
"Password must contain at least one digit."
]
}429 Too Many Requests
Throttle limit exceeded (5 per minute per IP). The Retry-After header gives the seconds until the next request is allowed.
{
"detail": "Request was throttled. Expected available in 42 seconds."
}Post-Registration Flow
- User is saved to the database with
is_verified=False. - A cryptographically strong 6-digit code is generated.
- The code is hashed and stored, never in plain text.
- The raw code is emailed to the user.
- The user must verify their email via the verify endpoint before the code expires (15 min).
ParametersTry it out
No parameters
Request body requiredapplication/json
Example Value | Schema
{
"email": "user@example.com",
"first_name": "string",
"last_name": "string",
"password": "string",
"confirm_password": "string"
}Responses
CodeDescription
201
Created
400
Bad Request
429
Too Many Requests
POST/api/auth/verify-email/Verify email with 6-digit code
POST/api/auth/login/Obtain access and refresh tokens
POST/api/auth/token/refresh/Rotate refresh token
GET/api/users/me/Retrieve the current user
PATCH/api/users/me/Update profile fields
DELETE/api/users/me/Delete account
05
How it works
- 01
Discovery
A call about your product, your users, and what's already built. You get a written scope and timeline before any code is written.
- 02
Build
Built in small, tested pieces on a staging environment you can try as it comes together. No disappearing for weeks.
- 03
Deploy
Shipped to production through an automated pipeline, with monitoring in place and API docs ready for your team.
- 04
Ongoing support
After launch, a flat monthly fee covers updates, bug fixes, and monitoring. The person who built it keeps it running.
06
Get started
Tell me what you're building, or what's broken.
The quickest route is a 30-minute call. We'll talk through what you need and whether I'm the right fit. Prefer writing? Send a message or email me directly.