A production-ready banking API with ACID compliance, ledger tracking, and enterprise-grade security.
JWT authentication with token blacklist, bcrypt hashing, and dual middleware for role-based access control.
Multi-account support with ACTIVE status tracking, balance calculation from immutable ledger entries.
Money transfers with idempotency keys, 7-second delay for concurrency, and email notifications.
Immutable audit trail with DEBIT/CREDIT entries, pre-hooks preventing modifications after creation.
ACID transactions, race condition prevention, unique constraints on idempotency keys.
OAuth2 Gmail integration for registration emails and real-time transaction alerts.
Full ACID compliance ensures financial transactions are reliable and secure under concurrent load. Implemented using MongoDB 4.0+ transactions.
Include header Authorization: Bearer <token>
POST /api/auth/logout adds token to blacklist with 3-day auto-expiry
Use unique UUID v4 for each transaction to prevent duplicates
Total Credits - Total Debits (calculated from immutable ledger)
Between DEBIT and CREDIT creation for concurrent request handling
Both sender and receiver get email alerts for all transactions
# 1. Register new user
POST /api/auth/register
{
"name": "John Doe",
"email": "john@example.com",
"password": "secure123"
}
# 2. Login to get token
POST /api/auth/login
{
"email": "john@example.com",
"password": "secure123"
}
# 3. Create account
POST /api/accounts
Authorization: Bearer <token>
# 4. Check balance
GET /api/accounts/balance
Authorization: Bearer <token>
# 5. Transfer money (use unique idempotencyKey)
POST /api/transactions
Authorization: Bearer <token>
{
"fromUserAccount": "acc_123",
"toUserAccount": "acc_456",
"amount": 1000,
"idempotencyKey": "550e8400-e29b-41d4-a716-446655440000"
}
# 6. Logout (blacklist token)
POST /api/auth/logout
Authorization: Bearer <token>