How to Connect Next.js + Node.js API for a Production-Ready MVP
How to Connect Next.js + Node.js API for a Production-Ready MVP
Most Next.js MVPs don't need a separate backend — API Routes and Server Actions handle everything. But when you do need a separate Node.js API, here's how to connect them properly.
Do You Actually Need a Separate Backend?
Use Next.js API Routes When:
- Your backend logic is straightforward CRUD
- You're deploying to Vercel (serverless API Routes work great)
- You don't need WebSockets or long-running processes
- Your team is comfortable with Next.js
Add a Separate Node.js API When:
- You need WebSockets (real-time features)
- You have long-running background jobs
- You need to serve multiple clients (web app, mobile app, third-party API)
- Your API logic is complex enough to warrant separation
- You need a persistent server process
Architecture Pattern
Next.js (Frontend + BFF) Node.js API (Backend)
┌──────────────────┐ ┌──────────────────┐
│ React Components │ │ Express/Fastify │
│ Server Components│ ──API──→│ Business Logic │
│ API Routes (BFF) │ │ Database Access │
│ Server Actions │ │ Background Jobs │
└──────────────────┘ └──────────────────┘
Vercel Railway/Fly.io
BFF (Backend for Frontend): Your Next.js API Routes act as a thin proxy, handling auth cookies and forwarding requests to the Node.js API. This keeps auth logic on the frontend server and business logic on the backend.
Communication Patterns
REST API (Recommended)
Standard HTTP requests from Next.js Server Components or API Routes to the Node.js API.
tRPC (Type-Safe Alternative)
Share TypeScript types between frontend and backend. Full end-to-end type safety with zero code generation.
GraphQL (Overkill for Most MVPs)
Flexible but adds complexity. Use only if you have many clients with different data needs.
Authentication Between Services
Pattern: Shared JWT or Session
- User logs in via Next.js (sets HTTP-only cookie)
- Next.js API Route reads cookie, extracts user info
- Next.js API Route forwards request to Node.js API with an internal auth header
- Node.js API verifies the internal auth header
Never expose the Node.js API directly to the browser. Always go through Next.js as the BFF.
Deployment
| Service | Platform | Why |
|---|---|---|
| Next.js | Vercel | Optimized for Next.js, global edge |
| Node.js API | Railway | Easy Node.js hosting with databases |
| Database | Neon | Serverless PostgreSQL |
Environment Variables
NEXT_PUBLIC_*— Only for client-side valuesAPI_URL— Internal Node.js API URL (not exposed to client)API_SECRET— Shared secret for service-to-service auth
Building with Next.js only? Browse Next.js boilerplates on MVPHub.
Node.js architecture: Read Node.js MVP Architecture.
