Backend Development Glossary
100 backend concepts explained the developer way — direct definitions, runnable code in four languages, architecture diagrams, and honest comparison tables. No history lessons.
Cloud Architecture & Hosting Paradigms
Mobile Backend-as-a-Service (MBaaS) vs. BaaS MBaaS is a mobile-first form of Backend-as-a-Service; BaaS is the broader model serving mobile, web, and server clients alike. Open-Source BaaS vs. Proprietary Managed BaaS Open-source BaaS is a backend platform whose core you can self-host; a proprietary BaaS runs only on infrastructure the vendor controls. Scaling Modern Application Backends Scaling a modern application backend is a process of adding capacity — compute, database, delivery — so growing traffic stays fast. Staging vs. Production Environment Isolation in BaaS Staging-production isolation is a practice of running separate apps, databases, and keys per environment so tests never touch live data. Managed Object Storage & Asset Delivery Pipelines Managed object storage is a BaaS service that stores files uploaded through SDKs and serves them via CDN-backed URLs with access control. BaaS vs. Building a Custom Backend BaaS vs. a custom backend is a build-vs-buy decision: adopt a ready backend behind an SDK, or design and operate your own. Serverless Architecture Serverless architecture is a cloud execution model where the provider runs your code on demand, so you never provision or manage servers. Platform-as-a-Service (PaaS) vs. BaaS PaaS is a cloud model where the provider runs the platform your code deploys onto, while you still write and manage the application. BaaS vs. Serverless Serverless is an execution model where the provider runs code on demand; BaaS is a serverless model that ships the backend pre-built. Infrastructure-as-a-Service (IaaS) IaaS is a cloud model that rents fundamental computing resources — virtual machines, storage, networking — on demand, billed as you go. No-Ops (Zero-Ops) Development No-Ops is an operating model where infrastructure work is so automated by the platform that developers ship code with no operations team. Decoupled Architecture (Headless Backend) Decoupled architecture is a design where the frontend and backend are separate systems that communicate only through APIs. Microservices vs. Monolith Architecture A monolith is a single deployable application; microservices split it into small, independently deployed services that talk over APIs. Multi-Tenant Cloud Hosting Multi-tenant cloud hosting is a model where one set of servers and software serves many customers, with logical isolation between tenants. Cloud Vendor Lock-In Cloud vendor lock-in is a dependence on one provider so deep that switching would cost more in money, time, and risk than staying. Backend Boilerplate Code Backend boilerplate code is a mass of repetitive server-side plumbing — auth, CRUD, config — written the same way in project after project. Containerization Containerization is a way of packaging an app with all its dependencies into an isolated unit that runs identically on any host. Kubernetes Kubernetes is an open-source platform that automates deploying, scaling, and operating containerized applications across many machines. CI/CD (Continuous Integration & Delivery) CI/CD is a practice that automates building, testing, and releasing code, so every change moves from commit to production in small steps. CDN (Content Delivery Network) A CDN is a network of distributed servers that caches content close to users, so pages and files load fast everywhere. IaaS vs. PaaS vs. CaaS vs. FaaS vs. BaaS vs. mBaaS vs. SaaS The cloud service-model spectrum is a ladder — IaaS, CaaS, PaaS, FaaS, BaaS, mBaaS, SaaS — ranked by how much the provider runs for you.
Database Management & Scaling
Pointer vs. Relation Fields in BaaS Data Modeling A pointer field is a typed reference to a single object; a relation field is a managed join that links many objects to many. Serverless Connection Pooling in Managed Databases Serverless connection pooling is a technique that shares a few real database connections across many short-lived function instances. Point-in-Time Recovery (PITR) & Backups in BaaS Point-in-time recovery is a restore method that replays a change log over a base backup to rebuild a database as of any chosen second. Geospatial Queries & Location-Based Indexing in BaaS A geospatial query is a database lookup that filters and sorts records by location — near a point, within a radius, or inside an area. Multi-Region Database Replication & Latency Optimization Multi-region replication is a database topology that copies data across geographic regions to cut read latency and survive outages. Database Abstraction Layer A database abstraction layer is an API between your code and the database that hides which engine, dialect, and driver sit underneath. Multi-Tenant Database Architecture Multi-tenant database architecture is a design for storing many customers in one data tier, isolated by row, schema, or separate database. Row-Level Security (RLS) Row-level security is a database mechanism that filters which rows each user can see or change, enforced by policies on every query. Relational Queries (Joins) in Document Databases A relational query in a document database is a join done with references and lookups instead of foreign keys — or avoided by embedding. Auto-Generated Database APIs (GraphQL & REST) An auto-generated database API is an interface built by a tool that reads your schema and exposes REST or GraphQL endpoints for it. Visual Database Management (Spreadsheet-Like Interfaces) Visual database management is a way of working with data through a graphical interface — grids, forms, filters — instead of raw queries. Data-Layer Security vs. Application-Layer Security Application-layer security is a guard in your code; data-layer security is a guard on the data itself — real systems need both. Tenant Isolation in Shared Cloud Databases Tenant isolation is a discipline of walls inside shared systems — controls that keep every tenant sealed off from every other tenant. Class-Level Permissions (CLPs) & Schema Security A class-level permission is a rule on a class schema that controls which users or roles may run each operation on that class at all. NoSQL vs. SQL Databases A SQL database is a relational store with fixed tables and joins; NoSQL is an umbrella of flexible models built to scale out. Database Schema A database schema is a blueprint that defines how data is organized — the classes, columns, types, and relationships, but not the data. Database Queries & Query Languages A database query is a structured request for data — filter, sort, project, paginate — written in a language the engine can plan and run. Database Index A database index is a sorted lookup structure that lets the engine find matching rows directly instead of scanning the whole table. ACID Transactions An ACID transaction is a group of database operations that commits as one unit — atomic, consistent, isolated, and durable. Data Modeling (Pointers & Relations) Data modeling is a process of mapping entities, attributes, and relationships before deciding how a database will store them. CRUD (Create, Read, Update, Delete) CRUD is a shorthand for create, read, update, and delete — the four basic operations every persistent data store must support.
API Design & Real-Time Sync
Offline-First Data Synchronization in Mobile Backends Offline-first sync is an architecture where the app reads and writes a local store first, then reconciles with the server when online. Real-Time Push Notifications vs. Live Query Subscriptions A push notification is an OS-delivered alert that reaches closed apps; a live query streams data changes while the app is open. GraphQL Subscriptions vs. WebSockets in Managed Backends A GraphQL subscription is a typed, schema-defined event stream; a WebSocket is the raw transport it usually rides on. GraphQL vs. REST API REST is an API style with many fixed endpoints; GraphQL is a query language where clients ask one endpoint for just the fields they need. WebSockets & Real-Time Sync A WebSocket is a persistent, two-way connection between client and server, letting either side push messages the instant they happen. API Rate Limiting & Throttling Rate limiting is a control that caps how many requests a client may make per window; throttling slows the excess instead of rejecting it. API Gateway Architecture An API gateway is a managed front door for your APIs — one entry point that routes, authenticates, and rate-limits every request. Backend SDK (Software Development Kit) A backend SDK is a toolkit of libraries and helpers that lets apps talk to a backend service in their own language, without raw HTTP. N+1 Query Problem The N+1 query problem is a pattern where fetching N records triggers one extra query per record — N+1 round trips instead of one or two. API Payload Optimization API payload optimization is a practice of shrinking what an API sends — fewer fields, smaller pages, compression — so responses load fast. Cross-Origin Resource Sharing (CORS) CORS is a browser mechanism that lets a server declare which other origins may call it, relaxing the same-origin policy on purpose. Real-Time Live Queries A live query is a subscription to a database query — the server pushes create, update, and delete events for matching rows as they happen. Overfetching & Underfetching Overfetching is an API problem where responses carry more data than the client needs; underfetching forces extra requests to get enough. API (Application Programming Interface) An API is a set of rules that lets one application request data and functionality from another without knowing its internal code. REST API A REST API is an API that follows the REST architectural style: resources at URLs, stateless requests, and standard HTTP methods. GraphQL GraphQL is a query language for APIs and a server-side runtime that returns exactly the fields each client asks for in one request. API Endpoint An API endpoint is a specific URL where an API receives requests for one resource — paired with an HTTP method, it defines one operation. Server-Sent Events vs. WebSockets vs. Polling Polling is a pull model where clients ask repeatedly; SSE and WebSockets hold one connection open so the server can push in real time. Pub/Sub (Publish-Subscribe) Pattern Pub/sub is a messaging pattern where publishers send messages to topics on a broker, and every subscriber to a topic gets a copy. Presence (Online Status) Presence is a real-time signal of whether a user is currently online, away, or offline, kept fresh by connections and heartbeats.
User Authentication & Security
BaaS Security Hardening: CLPs, ACLs, and Master Key Protection BaaS security hardening is a layered set of controls — CLPs, ACLs, and key discipline — that closes the openings a backend ships with. Social Auth Adapters: OAuth Integration in BaaS A social auth adapter is a backend component that verifies tokens from an identity provider and turns them into a user record and session. JSON Web Token (JWT) A JSON Web Token is a compact, URL-safe token that carries signed JSON claims, letting servers verify requests without stored sessions. OAuth 2.0 & Social Login OAuth 2.0 is an authorization standard that lets apps access a user account on another service — social login builds sign-in on top. Access Control Lists (ACL) An access control list is a list attached to a resource naming which users or roles may access it and what each is allowed to do. Role-Based Access Control (RBAC) Role-based access control is an authorization model where permissions attach to roles, and users get permissions only through their roles. Identity and Access Management (IAM) IAM is a framework of policies and technologies ensuring the right users get the right access to the right resources at the right time. Multi-Factor Authentication (MFA) Multi-factor authentication is a login control requiring two or more different kinds of proof — something you know, have, or are. API Key Security An API key is a unique string identifying the calling app to an API; API key security is the discipline of scoping and protecting it. Cross-Site Scripting (XSS) Prevention Cross-site scripting is an attack that injects malicious scripts into trusted pages; prevention means encoding output per context. Data Encryption at Rest and In Transit Encryption at rest is a control that makes stored data unreadable without keys; encryption in transit protects data crossing networks. Passwordless Authentication Passwordless authentication is a login model that verifies identity with a device-held key or biometric instead of a memorized secret. Authentication vs. Authorization Authentication is a check of who you are; authorization is the per-request decision of what you may do. Every secure system needs both. Session Management Session management is a discipline for creating, validating, and destroying the server-side state that ties HTTP requests to one user. Single Sign-On (SSO) Single sign-on is an authentication method where one login at an identity provider grants access to many independent applications.
Backend Logic & Serverless Compute
Serverless Cloud Functions vs. Custom Microservices A serverless cloud function is a single deployable unit of backend logic; a microservice is a whole independently operated service. Cloud Code (Serverless Functions) Cloud Code is a serverless model where backend logic runs as server-side functions triggered by calls, data events, or schedules. Webhooks (Event-Driven Webhooks) A webhook is an automated HTTP callback: when an event occurs, one system POSTs a payload to a URL another system registered. Background Jobs & Task Schedulers A background job is a task that runs outside the request cycle — enqueued by the app, executed by workers, retried on failure. Push Notifications (APNs & FCM) A push notification is a server-initiated message the platform push services deliver to a device, even when the app is closed. Database Triggers (BeforeSave and AfterSave) A database trigger is a code hook that runs automatically on data events — before a save to validate, after it to react. Serverless Cold Starts A cold start is a latency penalty paid when a serverless platform must create and initialize a new environment before running your code. Edge Computing & Serverless Edge Functions Edge computing is a model that runs compute near users or data sources; edge functions are serverless code executing at CDN locations. Scheduled Cloud Code (Cron Jobs) A cron job is a task that runs automatically on a time schedule; scheduled Cloud Code applies the idea to serverless functions. API Orchestration API orchestration is a pattern where one coordinating layer calls multiple APIs in sequence and returns a single combined result. Event-Driven Architecture (EDA) Event-driven architecture is a design style where services announce immutable facts as events, and consumers react independently. Middleware (Request Lifecycle) Middleware is a function in the request pipeline that inspects or modifies requests and responses before your route logic runs.
AI & the Modern Stack
Vibe Coding Vibe coding is a workflow where you build software by prompting an AI and accepting its generated code largely without review. MCP (Model Context Protocol) MCP is an open standard that lets AI applications connect to external tools and data through one protocol instead of custom integrations. RAG (Retrieval-Augmented Generation) RAG is a technique that retrieves documents at query time and adds them to the prompt, so an LLM answers from data, not memory. Vector Database & Embeddings An embedding is a numeric vector capturing meaning; a vector database stores and searches those vectors by similarity, not exact match. LLM API An LLM API is an HTTP endpoint to a hosted language model: send a prompt, get generated text back, billed per token. AI Agent An AI agent is an LLM-driven system that pursues a goal in a loop: reason, call a tool, observe the result, and repeat. Webhooks vs. Agent Tool Calling Agent tool calling is a pull where an AI decides to invoke a function; a webhook is a push when an external event happens.
Frontend & Web Delivery
SSR vs. CSR vs. SSG SSR vs. CSR vs. SSG is a comparison of rendering strategies by where and when HTML is generated: build time, server, or browser. JAMstack JAMstack is a web architecture that prebuilds the frontend into static markup on a CDN, with JavaScript and APIs for dynamic features. PWA (Progressive Web App) A PWA is a web app that uses service workers, a manifest, and HTTPS to be installable, work offline, and receive push notifications. Cross-Platform Development Cross-platform development is a way to build an app from one shared codebase that runs on multiple platforms — iOS, Android, web, desktop.