Node.js Development in Singapore

About Node.js Development

Our Node.js development services cover the backend a product actually runs on: REST and GraphQL APIs, real-time features, mobile app backends and custom Node.js application development, all in TypeScript. Node.js is our default backend choice when a project needs speed-to-ship, real-time features, or a single language across the stack. We've built Node.js backends for SaaS dashboards, mobile apps, multi-tenant platforms, and real-time collaboration tools, using NestJS, Express, or Fastify depending on what fits the team and scale. Proper testing, observability built in, and deployment automated from day one.

What the engagement includes

• REST API development (Express, Fastify, NestJS)
• GraphQL API development (Apollo Server, Pothos, Yoga)
• Real-time backends (Socket.IO, native WebSockets, server-sent events)
• Microservices architecture and service mesh (NATS, RabbitMQ, gRPC)
• Authentication systems (JWT, OAuth 2.0, Auth.js, Clerk)
• Database design and ORM setup (Postgres, MongoDB, Prisma, Drizzle)
• Background job systems (BullMQ, Agenda, Trigger.dev)
• Third-party API integrations (Stripe, Razorpay, Twilio, SendGrid)

SMS sender IDs, FormSG webhooks and government data APIs in a Singapore Node.js backend

The first Singapore problem a Node.js backend tends to meet is the one-time password. Since 31 January 2023 IMDA's SMS Sender ID Registry has required every organisation that sends SMS under an alphanumeric sender ID, five-digit short codes beginning with 7 included, to register it, and a message under an unregistered ID reaches the phone relabelled Likely-SCAM. Two conditions make that a design decision rather than paperwork. Registration needs a Singapore UEN, so a foreign company without a local subsidiary or branch cannot register a sender ID at all. And a registered ID can only be sent through aggregators that participate in the registry, which rules out a global SMS provider's default route unless that provider participates for Singapore. The Shared Responsibility Framework, in effect since 16 December 2024, expects the telcos to deliver sender ID messages only from authorised aggregators and to run an anti-scam filter that checks links against known malicious ones. ScamShield's own guidance says it does not filter Likely-SCAM messages because they may carry legitimate codes from a foreign business that never registered, so your OTP still arrives, under a label that teaches your users to distrust you. In the backend that means routing by destination: Singapore numbers go to a participating aggregator under the registered ID, delivery receipts are tracked per route so a silent fallback to an unregistered path shows up in monitoring, and the OTP text carries no link, since links are what the filter inspects. Where the code can be replaced altogether, a Singpass login or an in-app prompt avoids SMS for that step. The registration is in your entity's name, not ours, so it is filed in the first week alongside the aggregator contract rather than discovered when the first test message lands with the wrong label. Whether your messages fall within the regime is for your own counsel.

When the buyer is a public agency, the form at the front of the process is often already built in FormSG, the form builder Open Government Products runs for public officers, and the Node.js work is the system that receives what it collects. A Storage mode form sends each response to one webhook URL, and the response arrives end-to-end encrypted: the respondent's browser encrypts it before FormSG stores it, and only the holder of the form's secret key can read it. The reference SDK for receiving it, @opengovsg/formsg-sdk, is a JavaScript package for Node.js. It verifies the X-FormSG-Signature header, an ed25519 signature over the endpoint URL, submission ID, form ID and timestamp, before the body is parsed, then decrypts the submission with the secret key, and the documentation adds a five-minute tolerance on the timestamp, a check that the form ID is expected and a refusal of any submission ID already seen. Three details shape the receiving service. FormSG cannot recover a lost secret key, or the responses it protects, so the key lives in a secrets manager the agency controls rather than in the repository or an environment file on a laptop. Attachments come as pre-signed links that expire after one hour and are not scanned for malicious content, so a worker fetches and decrypts them promptly and scans them before anyone opens them. And with retries switched on, FormSG resends a failed webhook up to six more times over the following day, from about five minutes to about twenty hours after submission, treats a slow reply as a failure, and expects the receiver to cope with duplicates, out-of-order delivery and submissions arriving after the form has closed. So the endpoint verifies the signature, stores the encrypted payload, returns a 2xx at once and leaves decryption to a queue keyed on submission ID, which turns a retry into a no-op. Which classification of data a form may carry is for the agency's own governance.

Singapore publishes a great deal of government data a Node.js backend can use, address search and geocoding from OneMap, transport data from LTA DataMall, weather and other live feeds from data.gov.sg, and each of the three fails in production in its own way. A OneMap token is issued against a registered account's email and password, is valid for 3 days and does not renew itself, so a service that fetched one at deployment starts failing on the fourth day. Its Search API now requires a token too, and OneMap moved its JWT signing from HS256 to RS256 on 2 July 2025, so client code that decoded tokens against the old algorithm needed changing. The token is refreshed by a scheduled job and shared by every instance through one store, not fetched separately by each process. data.gov.sg introduced API keys in October 2025 and has applied rate limits since 1 November 2025, counted per 10-second window and answered with HTTP 429 when exceeded: its v2 real-time API allows 6 calls a window without a key and 30 with a production key. Keys expire, with reminder emails starting three months before, so the expiry date belongs in monitoring rather than in somebody's inbox. LTA DataMall authenticates with an AccountKey header and returns at most 500 records a call, Bus Arrival aside, with a $skip parameter to page through the rest, so loading a full dataset is a paged job rather than a single request. OneMap and DataMall are both used under the Singapore Open Data Licence, accepted at sign-up. The pattern is the same for all three: one cached client per source, backoff when a 429 arrives, and a fallback when a feed is slow, because a checkout or a booking flow should not stop because a postcode lookup or a bus arrival time did.

How we work with Singapore clients

Singapore is the one market we serve where the working day is simply shared. We are two and a half hours behind you and neither country moves its clocks, so our morning starts partway through yours and the whole of your afternoon is live time for both sides. That changes the shape of an engagement more than anything technical does: a call is booked for the same afternoon rather than the same week, a question raised before your lunch is answered after it, and the written-first method we run for North American clients is a courtesy here rather than a necessity. We keep the written record anyway, with a default chosen on every open decision, because it is the thing an auditor or a new hire can read later and a call is not.

Invoicing is worth stating plainly because the GST position confuses buyers on both sides. We are outside Singapore, so no GST appears on our invoice. Whether you account for it yourself is the reverse charge question, and IRAS's own guidance is that a GST-registered business making only taxable supplies is not affected, while a partially exempt one accounts for it in its own return. We quote in Singapore dollars, the figure holds for the project whatever the rupee does, and payment by bank transfer or Wise avoids the card fees a five-figure invoice does not need. The contract can sit under Singapore law with Singapore courts, and unusually among our overseas markets that clause has teeth: Singapore is a reciprocating territory under section 44A of India's Civil Procedure Code, so a judgment of the Singapore High Court can be executed in India directly rather than re-litigated.

Indicative pricing in SGD

Converted from our published Indian rates and rounded. Exchange rates move, so the figure on your quote is calculated on the day it is issued.

Questions Singapore clients ask

Node.js Development: common questions

Other markets we work in