---
title: "ZudoJS application development — ZudoJS Academy"
description: "Build real applications: security primitives, cryptography, authentication, OAuth and permissions, databases, transactions, storage and uploads, caching, OpenAPI, and type-safe application design."
source: https://zudojs.oyinlola.site/learn/zudo-applications
---

LEVEL 13 · ZUDOJS

Course Core

# ZudoJS application development

Build real applications: security primitives, cryptography, authentication, OAuth and permissions, databases, transactions, storage and uploads, caching, OpenAPI, and type-safe application design.

- **8 lessons**
- **6 h** to read and try
- **Before this:** [ZudoJS fundamentals](https://zudojs.oyinlola.site/learn/zudo-fundamentals)

0 of 8 lessons done

[Start lesson 1 →](https://zudojs.oyinlola.site/learn/zudo-database)

## When you finish, you can

- Secure a public API with @zudojs/security
- Authenticate users with passwords, sessions, JWTs and OAuth
- Authorise actions with roles, attributes and resource rules
- Persist data with repositories, migrations and transactions
- Store files and cache hot data
- Document the API with OpenAPI

**You build:** The Task API with users, roles, PostgreSQL, uploads, caching and API documentation

MODULE 1

## Data

1. [1**Databases with @zudojs/database**Connect the Task API to PostgreSQL through @zudojs/database, with migrations, seeds, a repository, a query builder, pagination, transactions and health checks, all running against real PostgreSQL.50 min](https://zudojs.oyinlola.site/learn/zudo-database)
2. [2**Storage abstractions**Use @zudojs/storage's driver-independent contracts for databases, files, serialization, locks, connection pools and start-up and shutdown, with a PostgreSQL adapter and local file storage for the Task API.Advanced45 min](https://zudojs.oyinlola.site/learn/zudo-storage)
3. [3**Transactions**Coordinate transactions across many functions with @zudojs/transactions, with context that follows your code through AsyncLocalStorage, rollbacks, savepoints, after-commit hooks, retries, timeouts and rollback-only state, against real PostgreSQL.Advanced45 min](https://zudojs.oyinlola.site/learn/zudo-transactions)

MODULE 2

## Security and identity

1. [4**Authentication**Let users log in to the Task API. Hash passwords, issue and check JWTs, keep server-side sessions with a real logout, protect routes in @zudojs/http, and stop password guessing with lockouts and rate limits, using @zudojs/auth and @zudojs/crypto.55 min](https://zudojs.oyinlola.site/learn/zudo-auth)
2. [5**Sign in with OAuth**Add "Sign in with Google" to the Task API with @zudojs/auth-oauth. Learn the OAuth 2 authorization code flow, state and PKCE, the provider presets, and the callback, all tested offline against a stand-in provider.Advanced50 min](https://zudojs.oyinlola.site/learn/zudo-oauth)
3. [6**Permissions**Decide what each logged-in user may do with @zudojs/permissions. Roles, resource:action permissions, wildcards, role hierarchy, owner rules, deny rules, policies and explain mode, and the mistakes that let a normal user become an admin.45 min](https://zudojs.oyinlola.site/learn/zudo-permissions)
4. [7**Security for every public API**Protect the Task API from the open internet with @zudojs/security and the security helpers in @zudojs/http. Rate limiting, CORS, CSRF, security headers, HSTS and CSP, secure cookies, body limits, SSRF protection and input checks, each shown blocking a real attack.50 min](https://zudojs.oyinlola.site/learn/zudo-security)

MODULE 3

## Caching

1. [8**Caching**Keep copies of slow results so the Task API can answer again fast. Learn keys, TTL, namespaces, tags and invalidation, stampede protection, locks and cache metrics with @zudojs/cache.40 min](https://zudojs.oyinlola.site/learn/zudo-cache)

## Course checkpoint

Prove you can move on. The checkpoint picks 20 questions at random from every lesson in this course. Get 16 right to pass. Your result is saved in this browser only.