How to Connect Next.js + Node.js API for a Production-Ready MVP

Most Next.js MVPs don't need a separate backend — API Routes and Server Actions handle everything. But when you do need a separate Node.js API, here's how to connect them properly.

---

Do You Actually Need a Separate Backend?

Use Next.js API Routes When:

• Your backend logic is straightforward CRUD
• You're deploying to Vercel (serverless API Routes work great)
• You don't need WebSockets or long-running processes
• Your team is comfortable with Next.js

Add a Separate Node.js API When:

• You need WebSockets (real-time features)
• You have long-running background jobs
• You need to serve multiple clients (web app, mobile app, third-party API)
• Your API logic is complex enough to warrant separation
• You need a persistent server process

---

Architecture Pattern

Next.js (Frontend + BFF)     Node.js API (Backend)
┌──────────────────┐         ┌──────────────────┐
│ React Components │         │ Express/Fastify   │
│ Server Components│ ──API──→│ Business Logic    │
│ API Routes (BFF) │         │ Database Access   │
│ Server Actions   │         │ Background Jobs   │
└──────────────────┘         └──────────────────┘
    Vercel                    Railway/Fly.io

BFF (Backend for Frontend): Your Next.js API Routes act as a thin proxy, handling auth cookies and forwarding requests to the Node.js API. This keeps auth logic on the frontend server and business logic on the backend.

---

Communication Patterns

REST API (Recommended)

Standard HTTP requests from Next.js Server Components or API Routes to the Node.js API.

tRPC (Type-Safe Alternative)

Share TypeScript types between frontend and backend. Full end-to-end type safety with zero code generation.

GraphQL (Overkill for Most MVPs)

Flexible but adds complexity. Use only if you have many clients with different data needs.

---

Authentication Between Services

Pattern: Shared JWT or Session

1. User logs in via Next.js (sets HTTP-only cookie)
2. Next.js API Route reads cookie, extracts user info
3. Next.js API Route forwards request to Node.js API with an internal auth header
4. Node.js API verifies the internal auth header

Never expose the Node.js API directly to the browser. Always go through Next.js as the BFF.

---

Deployment

Environment Variables

• NEXT_PUBLIC_* — Only for client-side values
• API_URL — Internal Node.js API URL (not exposed to client)
• API_SECRET — Shared secret for service-to-service auth

---

Building with Next.js only? Browse Next.js boilerplates on MVPHub.

Node.js architecture: Read Node.js MVP Architecture.

---