What this covers
- REST APIs and webhooks
- Authentication and session/token handling
- Databases and data modeling
- Business logic — the actual rules your product needs to enforce
- Third-party API integrations (CRM, payment, calendar, AI providers)
- Backends specifically for mobile apps (see [What Backend Does a Mobile App Need?](/ai/mobile-app-backend-requirements/))
- Queues and scheduled jobs for background/async work
- Error handling, logging and security
When a business needs a custom API — not just a plugin
See When Does a Business Need a Custom API? for the honest signals — usually when off-the-shelf integrations can't express your actual business logic, not as a default first move.
Security and documentation
Authentication boundaries, rate limiting where relevant, and documented endpoints so your own team (or a future developer) can understand and extend the API without reverse-engineering it.
Who this is for
Businesses building a web application, a mobile app, or needing a backend specifically to power integrations or AI features that a website alone doesn't need.
Questions
Do we need this if we already have a website?+
Only if the website needs to do more than present content and capture leads — a marketing site alone usually doesn't need a dedicated custom backend.
Can this power a mobile app we're building elsewhere?+
Yes — backend/API work for a mobile app being built by a different team (native specialists, for example) is a common, standalone engagement.
How is security handled?+
Authentication boundaries and rate limiting are scoped per project, based on what data and actions the API actually exposes.