Summary: Measure first, find the bottleneck (usually the database or external calls), then apply the right caching, queues, and limits.

1. Measure Properly

  • Monitor p50, p95, p99 latency per endpoint, not just the average.
  • Track error rate, throughput, and CPU/memory use.
  • Use tracing (OpenTelemetry) to see time per step within one request.

2. The Most Common Bottlenecks

Cause Symptom Fix
Slow queries/N+1 Latency grows with data Database optimization
Sequential external API calls Latency = sum of calls Parallelize, cache, set timeouts
Heavy work inside the request Long requests/timeouts Move to a queue
Oversized payloads Slow transfer Pagination, field selection, compression
Blocked event loop (Node.js) All requests slow down Move to workers, avoid heavy sync operations

3. Caching

  • Application cache (Redis) for frequently read, rarely changing data, with a TTL and a clear invalidation strategy.
  • HTTP cache (ETag, Cache-Control) for shareable responses.
  • CDN for assets and public responses.
  • Be careful with user data: never cache personal responses in a shared cache.

4. Queues for Heavy Tasks

Sending email, generating reports, processing images/PDFs, calling AI: do not do it inside the request. Put it in a queue (BullMQ/Redis or RabbitMQ), reply quickly to the user, and process in a worker with retries.

5. Pagination and Limits

  • Always paginate lists; use keyset for large data.
  • Cap request size and result counts.
  • Rate limiting protects against spikes and abuse.
  • Timeouts and a circuit breaker for external dependencies so one slow service does not take everything down.

6. Concurrency and Scale

Start with one well-tuned server; add instances behind a load balancer when needed. Make the app stateless (sessions in Redis/database) before scaling out.

7. Load Testing

Use k6 or Artillery on staging with realistic traffic. Find the breaking point before customers do.

Third-Party Integrations

Document vendor rate limits and apply retries with backoff (integration practices).

FAQ

When are microservices needed?

Rarely in early stages. An optimized modular monolith is usually enough until there is a clear scale or team need.

Is Redis mandatory?

No. Use it when there is data proven to be read often and expensive to compute.

Next steps

Request an API performance audit by sharing metrics or logs of your slowest endpoints.