Juspay Full Stack with Node.js Interview Questions & Answers
Curated interview practice questions with answers. These are practice scenarios, not a verified list of past interview questions.
About Juspay hiring for Full Stack with Node.js roles
Juspay is a Bengaluru-based payments technology company that builds payment orchestration, checkout and UPI infrastructure for merchants and banks. Its products help businesses manage multiple payment gateways and improve transaction success rates. It is known for using functional programming languages such as Haskell and PureScript, and hires software engineers and product engineers.
For Full Stack with Node.js roles, this Juspay practice set focuses most on Deployment, Scaling and Performance (7), Authentication and Security (5), Asynchronous JavaScript (5), Express.js Framework (4). It has 2 easy, 16 medium, 12 hard questions, so you can start easy and work up to the harder ones.
Company type
Fintech
Headquarters
Bengaluru, India
Main India offices
Bengaluru
Juspay Full Stack with Node.js interview process
Online coding assessment or hackathon-style challenge
Technical round 1 (problem solving)
Technical round 2 (design or functional programming)
Hiring manager and culture round
Typical pattern based on public candidate experiences. Rounds vary by role, team and year.
Solved for JuspayStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
Soft delete marks a record as deleted with a flag or deletedAt timestamp instead of removing it, so data can be restored and audited. Trade-offs: every query must filter out deleted rows, unique constraints need care, tables grow over time and privacy laws such as India's DPDP Act may require real deletion of personal data on request. Use partial indexes and periodic purging.
02
How do you implement rate limiting on a login endpoint?
// routes/users.js
const router = require('express').Router();
router.get('/', listUsers);
router.get('/:id', getUser);
router.post('/', auth, createUser);
module.exports = router;
// app.js
app.use(express.json());
app.use('/api/v1/users', require('./routes/users'));
// Keeps each resource in its own module with its own middleware.
04
What are async iterators and when would you use for await...of?
An async iterator returns promises from its next() method, and for await...of consumes them one by one. In Node, readable streams, readline interfaces and many database cursors are async iterable. It is ideal for processing paginated API results or large query cursors item by item with natural backpressure, since the next chunk is not pulled until the current one is handled.
Express is a minimal, unopinionated web framework for Node.js that adds routing, middleware and helpers for requests and responses on top of the http module. It is widely used because it is simple, flexible and has a large ecosystem of middleware for logging, auth, validation and security. Many teams also use it as the base for frameworks like NestJS.
06
How do you implement and secure webhooks that your API sends to customers?
Send a POST with a JSON event, a unique event ID and timestamp. Sign the body with HMAC-SHA256 using a per-customer secret and include it in a header, so receivers verify authenticity and reject old timestamps to stop replays. Retry failures with exponential backoff, log delivery attempts and make events idempotent so receivers can safely handle duplicates.
07
An API listing orders became slow after the table reached 50 million rows. How do you investigate?
Run EXPLAIN ANALYZE on the slow query to see whether it does a sequential scan or a costly sort. Add a composite index matching the filter and sort, for example (user_id, created_at DESC). Replace OFFSET pagination with cursor pagination, select only needed columns, and consider partitioning by date and archiving old rows. Monitor slow query logs after the change.
08
How do you use the Node.js cluster module to use all CPU cores?
const cluster = require('cluster');
const os = require('os');
if (cluster.isPrimary) {
for (let i = 0; i < os.availableParallelism(); i++) cluster.fork();
cluster.on('exit', (worker) => {
console.log(`Worker ${worker.process.pid} died, restarting`);
cluster.fork();
});
} else {
require('./server'); // each worker listens on the same port
}
// In Kubernetes, prefer one process per container and more replicas.
09
How do you optimise JSON serialisation for very large API responses?
Large JSON.stringify calls block the event loop. Reduce payload size with pagination and field selection first. For unavoidable large outputs, stream the response as NDJSON or a streamed JSON array, use schema-based fast serialisers like fast-json-stringify, which Fastify uses, and cache precomputed responses. Offload heavy transformation to worker threads or background jobs that write files to storage.
Centralise login in an identity service or provider such as Keycloak, Auth0 or Cognito that issues short-lived JWTs signed with RS256. The API gateway validates tokens, and each service verifies the signature using the public keys from a JWKS endpoint, so no shared secret is needed. Use service-to-service tokens or mTLS for internal calls and keep authorisation checks inside each service.
13
A test passes locally but fails randomly in CI. How do you approach this flaky test?
Run it repeatedly to reproduce, then look for shared state between tests, missing awaits, reliance on test order, real timers, current date or time zones, random data and network calls. Fix by isolating data per test, using fake timers, freezing dates, mocking external calls and awaiting all promises. Quarantine the test only temporarily with a ticket, never delete it silently.
If you call an async function without await, the try/catch only covers the synchronous part, so a later rejection escapes it and becomes an unhandled rejection that can crash the process. The function also continues before the work finishes, causing race conditions like responding before data is saved. ESLint rules such as no-floating-promises in TypeScript help catch this.
16
How do you design an API that needs to handle 50,000 requests per second for reading product details?
Make the read path cache-heavy: CDN caching for public product pages, Redis cache for product details with high hit ratio, and database read replicas behind it. Run many stateless Node instances with autoscaling, keep responses small and compressed, and use keep-alive connections. Avoid cache stampedes with request coalescing or locks, and precompute data that is expensive to build.
17
A partner integration retries POST requests on timeouts and creates duplicate orders in your API. How would you redesign the endpoint?
Require an Idempotency-Key header on order creation and store it with a unique index alongside the created order ID and response. On a repeated key with the same payload, return the original response; with a different payload, return 409 or 422. Also add a unique business constraint such as partner order reference, respond quickly by queueing slow work, and document retry behaviour for partners.
18
A Mongoose query returns large documents and the API is slow. What optimisations can you apply?
Use .select() to fetch only needed fields, and .lean() to return plain objects instead of full Mongoose documents, which cuts memory and CPU. Make sure the filter and sort use an index, checked with explain. Paginate results, avoid populating deep references, and cache frequently read data. For large exports, use a cursor with for await instead of loading everything.
19
How do you use a message queue to process background jobs in Node.js?
When a hot key expires, thousands of requests may hit the database at once. Solutions: allow only one request to rebuild the cache using a short Redis lock while others wait or serve stale data, refresh hot keys in the background before expiry, add random jitter to TTLs so keys do not expire together, and use stale-while-revalidate where slightly old data is acceptable.
21
npm audit reports a critical vulnerability in a dependency of a dependency. What do you do?
First check whether the vulnerable code path is actually reachable in our usage and read the advisory. Try npm audit fix or updating the parent package to a version that pulls a patched sub-dependency. If none exists, use the overrides field in package.json to force a safe version and run tests. Track it in a ticket and enable Dependabot or Renovate for ongoing updates.
22
What are health check endpoints and what is the difference between liveness and readiness?
Health endpoints let orchestrators check the app. Liveness answers whether the process is alive; if it fails, the container is restarted, so keep it simple. Readiness answers whether the instance can serve traffic, checking database and cache connections; if it fails, the load balancer stops sending requests but does not restart it. During shutdown, fail readiness first.
23
You need to choose between Node.js and Java for a new high-traffic service. How would you decide?
I would look at the workload and team. Node.js fits I/O-heavy services like API gateways, chat, notifications and BFF layers, with fast development and shared JavaScript skills. Java fits CPU-heavy processing, complex multi-threaded logic and teams with strong JVM experience. I would benchmark a prototype for the real access pattern and consider hiring, libraries and existing platform tooling before deciding.
I use a layered structure: routes define endpoints, controllers handle HTTP details, services hold business logic, and repositories or models talk to the database. Add middlewares, validators, config and utils folders, and group by feature, for example modules/orders, once the app grows. This keeps controllers thin, makes services unit-testable and avoids business rules leaking into routes.
25
How would you add OTP-based login for an Indian mobile app?
Generate a random 6-digit OTP with crypto.randomInt, store only its hash in Redis with a 5-minute TTL and an attempt counter, and send it through an SMS provider on a DLT-registered template. Verify with a timing-safe compare, limit to about 3 to 5 attempts and rate limit sends per number and IP. On success, issue access and refresh tokens and delete the OTP.
26
A dashboard endpoint makes five independent database queries one after another and takes 1.5 seconds. How would you speed it up?
Because the queries are independent, run them concurrently with Promise.all so total time is close to the slowest query instead of the sum. Check that the database connection pool is large enough to serve them in parallel. Then add indexes for slow queries, cache rarely changing parts in Redis, and use Promise.allSettled if the page can render with some widgets missing.
27
How do you load test a Node.js API before a big sale event?
Define targets from expected traffic, such as 5,000 requests per second with p95 under 300 ms. Write realistic scenarios in k6 or Artillery covering browse, cart and checkout, run them against a production-like environment, and ramp up gradually. Watch latency, error rates, CPU, memory, event loop lag and database metrics, then fix bottlenecks and rerun until targets are met with headroom.
28
Two simultaneous requests both read a wallet balance, deduct money and save it, causing a wrong balance. How do you fix this race condition?
Async code interleaves between awaits, so read-modify-write is unsafe. Make the update atomic in the database: use an UPDATE with balance = balance - amount WHERE balance >= amount, or MongoDB $inc with a filter. Alternatives are row-level locks with SELECT FOR UPDATE inside a transaction, optimistic locking with a version column, or a Redis distributed lock for cross-service work.
29
How do you prevent server-side request forgery when your API fetches a user-supplied URL?
An attacker could make your server call internal addresses such as 169.254.169.254 for cloud metadata or localhost admin ports. Allow only http and https, resolve the hostname and block private, loopback and link-local IP ranges, use an allowlist of domains where possible, disable redirects or revalidate them, set short timeouts and size limits, and run fetchers in an isolated network.
30
How do you enable compression and why should you be careful with it?
Use the compression middleware or, better, let Nginx or the CDN compress responses with gzip or Brotli, which reduces JSON payload size by 70 percent or more. Be careful: compressing in Node uses CPU on the event loop, small responses gain little, and already compressed files like images should be skipped. Never compress responses mixing secrets with user input over HTTPS because of BREACH-style attacks.
Tips to crack the Juspay Full Stack with Node.js interview
Practise DSA problems seriously, since Juspay hiring challenges are known to be competitive and focused on problem-solving ability.
Learn functional programming basics like immutability, pure functions and recursion, and try a little Haskell or PureScript.
Understand UPI and card payment flows, including authorisation and settlement, to discuss the domain with confidence.
Keep a one-minute story ready for every project on your CV: problem, your part, tools, result.
Practise the hard questions on this page aloud; Juspay interviewers usually ask follow-ups on your first answer.
Frequently asked questions
How many rounds are there in the Juspay Full Stack with Node.js interview?
Candidates usually go through 4 stages: Online coding assessment or hackathon-style challenge; Technical round 1 (problem solving); Technical round 2 (design or functional programming); Hiring manager and culture round. The exact rounds change with the role, team, location and your experience, so confirm the process with the recruiter.
Which topics should I prepare for the Juspay Full Stack with Node.js interview?
This practice set leans on Deployment, Scaling and Performance (7), Authentication and Security (5), Asynchronous JavaScript (5), Express.js Framework (4). Revise those first, then practise explaining one or two of your own projects end to end, because most Juspay interviewers ask you to walk through real work.
Are these the exact questions asked at Juspay?
No. These are curated practice questions that match the skills and difficulty usually tested in fintech interviews like Juspay's. They are not a leaked or verified list of past questions.
Where does Juspay hire Full Stack with Node.js professionals in India?
Juspay has large teams in Bengaluru. Openings and locations change often, so check the Juspay careers page and filter by city and experience.
Full Stack with Node.js questions for similar companies