Node.js Development in the UK

About Node.js Development

Our Node.js development services cover the backend a product actually runs on: REST and GraphQL APIs, real-time features, mobile app backends and custom Node.js application development, all in TypeScript. Node.js is our default backend choice when a project needs speed-to-ship, real-time features, or a single language across the stack. We've built Node.js backends for SaaS dashboards, mobile apps, multi-tenant platforms, and real-time collaboration tools, using NestJS, Express, or Fastify depending on what fits the team and scale. Proper testing, observability built in, and deployment automated from day one.

What the engagement includes

• REST API development (Express, Fastify, NestJS)
• GraphQL API development (Apollo Server, Pothos, Yoga)
• Real-time backends (Socket.IO, native WebSockets, server-sent events)
• Microservices architecture and service mesh (NATS, RabbitMQ, gRPC)
• Authentication systems (JWT, OAuth 2.0, Auth.js, Clerk)
• Database design and ORM setup (Postgres, MongoDB, Prisma, Drizzle)
• Background job systems (BullMQ, Agenda, Trigger.dev)
• Third-party API integrations (Stripe, Razorpay, Twilio, SendGrid)

Open banking permissions, GOV.UK's shared platforms and the new software security rules in a UK Node.js backend

Reading a UK customer's bank account or starting a payment from it through the banks' APIs is a regulated activity before it is a coding task. The FCA registers account information service providers and authorises payment initiation service providers under the Payment Services Regulations 2017, and a firm holding neither permission works as the registered agent of one or builds on a regulated provider's API. Which of those you choose decides what the Node.js service talks to. A firm with its own permission enrols in the Open Banking Directory, which issues the certificates its client presents to each bank, and builds against the Open Banking Standard, at version 4.0.1 since 1 April 2026, which uses the final FAPI 1 Advanced security profile. Consent runs on its own clock. Since the 2022 changes to the strong customer authentication rules a customer no longer has to reauthenticate with the bank every 90 days where the bank applies the exemption, but the provider must obtain the customer's explicit consent again at least every 90 days, so a scheduled job tracks the age of each consent, asks in good time and lets access lapse cleanly when nobody answers. Payments are where the market is moving. The CMA required the largest banks to offer variable recurring payments for sweeping money between a customer's own accounts, and commercial VRP, for utility bills, government, charities and financial services, is being rolled out through the UK Payments Initiative, which said on 2 June 2026 that it was moving into market rollout after live proving. The rules are moving as well: the Treasury has committed to a statutory instrument under the Data (Use and Access) Act 2025 by the end of 2026 to give the FCA powers over open banking, with an FCA policy statement planned for the first quarter of 2027. So the provider sits behind one adapter in our code, and which permission you need is for your own counsel.

Public sector work in the UK runs on shared platforms that a Node.js backend calls rather than rebuilds, and each sets terms the code has to follow. GOV.UK One Login is available to central government departments and agencies, with other organisations invited to get in touch. It is OpenID Connect with the authorisation code flow, and the client authenticates at the token endpoint with private_key_jwt, so the service holds a private key rather than a shared secret, sends a nonce and a state with every request, and uses PKCE with S256 where its client configuration enforces it. Once a user has proved their identity, the userinfo response carries a core identity claim as a JWT signed with ES256 and verified against a published did:web document. The documentation says that claim is valid for 30 minutes and must not be stored, so the callback verifies it, keeps only the fields the service needs, and never writes the token to a log, a session store or a queue payload. GOV.UK Notify, for email and text messages, is open only to public sector organisations, and a supplier works inside a service the public body creates and invites it to. Its official Node client is notifications-node-client, and a service in trial mode can send only to its own team, up to 50 emails and 50 texts a day, which is worth knowing before a demonstration to a wider audience. GOV.UK Pay is likewise for public sector organisations and not for commercial, profit-making purposes. The API key decides which service a call belongs to and whether a payment is a test or real, so keys are held per service and per environment. Every webhook carries a Pay-Signature header, an HMAC SHA-256 of the message body, which in an Express or NestJS app means verifying against the raw body before a JSON parser has reformatted it. Whether your organisation may use each platform is for its team to confirm.

UK buyers have started asking about software security in the words of a government code rather than a vendor questionnaire. The Software Security Code of Practice, published by DSIT and the NCSC on 7 May 2025, is voluntary and sets 14 principles across four themes for software vendors, and three land on a Node.js codebase. Principle 1.2 asks a vendor to understand the composition of its software and assess the risks of taking in and maintaining third-party components, which for Node means the resolved npm tree in the lockfile rather than the few dozen names in package.json. Principle 3.2 asks for a published vulnerability disclosure process. Principle 4.2 asks for at least a year's notice before the software stops being supported, and the runtime's own calendar decides how honest that notice can be: Node.js 22 reaches end of life on 30 April 2027 and Node.js 24 on 30 April 2028, so a product that cannot leave its Node major in time is promising support its runtime will not have. The Code comes with a self-assessment form a vendor can share with customers, which makes it a fair thing to ask any supplier to complete. The Cyber Security and Resilience Bill, introduced on 12 November 2025, is not law yet: it was in Lords committee in September 2026 with report stage set for 26 October. As drafted it brings relevant managed service providers under the ICO: firms providing ongoing management of a customer's IT systems with access to them, in the UK whether or not they are established here, small and micro enterprises excluded. They would owe the regulator and the NCSC an initial notice of an incident within 24 hours and a full report within 72, and would have to tell customers likely to be affected. A retained support contract with production access can look like that, so access logging and a named incident contact go in now. Whether the Bill would reach your supplier is for your counsel.

How we work with UK clients

UK engagements tend to start with procurement questions rather than technical ones. Who holds the data, which law governs the contract, whether you can produce a record of processing if the ICO asks. We answer those in the proposal instead of leaving them to a legal review three weeks in, because that review is where UK projects usually stall.

Invoicing is the other thing worth settling early. We are outside the UK, so services we supply generally fall under the reverse charge and your finance team accounts for the VAT rather than paying it to us. Our invoices say so explicitly. We quote in pounds, the figure does not move with the exchange rate mid-project, and payment by bank transfer avoids the card fees that make a five-figure invoice unnecessarily expensive.

Indicative pricing in GBP

Converted from our published Indian rates and rounded. Exchange rates move, so the figure on your quote is calculated on the day it is issued.

Questions UK clients ask

Node.js Development: common questions

Other markets we work in