API starters · Rank #11
express-boilerplate
Grade A: derived only from the two verdicts below. How grades work
Production-ready Express 5 and TypeScript API boilerplate with Drizzle ORM, PostgreSQL, secure authentication, OpenAPI, Vitest, Docker, Prometheus, and Grafana.
Why this verdict
How we check →- 5 commits in the last 90 days, none in the last 30. receipt ↗
- Latest release v2.0.0, 84 days ago. receipt ↗
- On current major: Drizzle, Express, Zod. receipt ↗
Snapshot: commit b43318d on main, checked 2026-10-19 06:54 UTC. Receipts link to files at this exact commit.
Dependency freshness
| Package | Declared | Latest | Status |
|---|---|---|---|
| Drizzle drizzle-orm | 0.45.2 | 0.45.4 | Current |
| Express express | 5.2.1 | 5.3.0 | Current |
| TypeScript typescript | 7.0.2 | 7.0.2 | Current |
| Zod zod | 4.4.3 | 4.6.7 | Current |
Declared = lowest version the kit's dependency file (package.json, pyproject.toml or requirements.txt) allows. Latest = the npm "latest" tag or the newest PyPI release. TypeScript, the Stripe SDK, FastAPI and other 0.x packages are shown but not counted in the verdict.
What's in the stack
- Framework
- Express
- Database / ORM
- Drizzle, node-postgres
- Nodemailer
- Testing
- Vitest
Detected from declared dependencies. A listed package means it's installed, not necessarily fully wired up.
What the README says you get
- AdminUser administration
user administration, and role/status changes
- AnalyticsPrometheus metrics
Prometheus HTTP, database, runtime, and garbage-collection metrics
- APIZod request validation
Express 5 with strict Zod request validation and stable response envelopes
- APIOpenAPI 3.1 reference
OpenAPI 3.1 with an interactive Scalar API reference
- AuthEmail verification
Registration, email verification, login, password reset, user administration
- AuthPassword reset
PostgreSQL-backed password-reset and verification-email requests with retries and recipient cooldowns
- AuthRotating refresh tokens
Rotating opaque refresh tokens stored only as SHA-256 hashes, with family-level reuse detection
- AuthJWT access tokens
Short-lived JWT access tokens
- AuthArgon2id password hashing
native asynchronous Argon2id hashing
- AuthHttpOnly refresh cookies
HttpOnly refresh cookies
- DataDrizzle migrations
PostgreSQL 18, Drizzle ORM, and reviewed Drizzle Kit migrations
- DeployHealth checks
Separate liveness and PostgreSQL-backed readiness checks
- OtherStructured logging redaction
Pino structured logging with recursive secret, URL-query, and embedded SQL-parameter redaction
- TestingVitest and Supertest tests
Vitest unit tests, Supertest HTTP tests, and opt-in PostgreSQL integration tests
Extracted from the kit's README by a local AI model (deepseek-flash) on Sep 29, 2026. Every item is checked against an exact README quote. A README claim is the maker's description, not something we tested.
Watch express-boilerplate
Get told if it goes dormant, gets archived, falls further behind on a core dependency, or changes its license or price.
History
Sep 29, 2026 → Oct 19, 2026. One square per check, colored by maintenance status. Hover for details.
Show as a table
| Date | Maintenance | Dependencies | Commits (90d) |
|---|---|---|---|
| Oct 19, 2026 | Steady | Current deps | 5 |
| Oct 12, 2026 | Steady | Current deps | 5 |
| Sep 29, 2026 | Steady | Current deps | 5 |
Sources
Every claim on this page comes from these public records, checked . Open them to verify.
- Commit history ↗ default branch (main) at the checked commit: pulse, contributors, last commit
- Releases ↗ latest release
- package.json ↗ declared dependency versions and stack (at commit b43318d)
- README ↗ quoted features at the checked commit
- npm registry ↗ latest versions (each linked in the table above)
Maintainer? Add the badge
It updates automatically every time we refresh the evidence. Clicking it opens this page.
[](https://kitproof.dev/kits/express-boilerplate/)