Backend Development with Kotlin and Ktor: Performance, Cost, and Code

1. Enable the authentication plugin in configureApplication().
2. Set up HMAC256 verifier with secret key and issuer.
3. Implement validate to extract JWTPrincipal with sub and role.
4. Add authenticate("jwt") block in routes for protected endpoints.
5. Write requireRole for access control.

Code example below.

Development Timeline

Timelines depend on complexity. Below are estimated stages for an average project.

Total: 7–12 weeks. More precise timelines after analyzing your project.

Implementation Details

Stack: Kotlin 2.0, Ktor 3.0, Exposed 0.54, Flyway, Koin, JWT. Below are code examples for typical configuration.

Application Setup

fun main() { embeddedServer(Netty, port = System.getenv("PORT")?.toInt() ?: 8080) { configureApplication() }.start(wait = true) } fun Application.configureApplication() { configureSerialization() configureAuthentication() configureRouting() configureStatusPages() configureCORS() } fun Application.configureSerialization() { install(ContentNegotiation) { json(Json { prettyPrint = false isLenient = false ignoreUnknownKeys = true encodeDefaults = false serializersModule = SerializersModule { // custom serializers } }) } } fun Application.configureCORS() { install(CORS) { allowMethod(HttpMethod.Options) allowMethod(HttpMethod.Put) allowMethod(HttpMethod.Delete) allowHeader(HttpHeaders.Authorization) allowHeader(HttpHeaders.ContentType) allowCredentials = true System.getenv("ALLOWED_ORIGINS")?.split(",")?.forEach { host -> allowHost(host.trim(), schemes = listOf("https", "http")) } } } 

Routing and Authentication

fun Application.configureRouting() { routing { route("/api/v1") { authRoutes() route("/products") { get { /* public */ productHandler.list(call) } get("/{id}") { productHandler.get(call) } authenticate("jwt") { post { productHandler.create(call) } put("/{id}") { productHandler.update(call) } delete("/{id}") { call.requireRole("admin") productHandler.delete(call) } } } authenticate("jwt") { get("/profile") { authHandler.profile(call) } } } } } fun Route.authRoutes() { route("/auth") { post("/login") { authHandler.login(call) } post("/refresh") { authHandler.refresh(call) } } } fun Application.configureAuthentication() { val secret = System.getenv("JWT_SECRET") ?: error("JWT_SECRET not set") val issuer = System.getenv("JWT_ISSUER") ?: "https://myapp.com" install(Authentication) { jwt("jwt") { realm = "myapp" verifier(JWT.require(Algorithm.HMAC256(secret)).withIssuer(issuer).build()) validate { credential -> if (credential.payload.getClaim("sub").asString().isNullOrBlank()) null else JWTPrincipal(credential.payload) } challenge { _, _ -> call.respond(HttpStatusCode.Unauthorized, mapOf("error" to "Invalid or expired token")) } } } } val JWTPrincipal.userId: Long get() = payload.getClaim("sub").asString().toLong() val JWTPrincipal.role: String get() = payload.getClaim("role").asString() ?: "user" suspend fun ApplicationCall.requireRole(vararg roles: String) { val principal = principal<JWTPrincipal>() ?: throw UnauthorizedException() if (principal.role !in roles) { throw ForbiddenException("Required role: ${roles.joinToString()}") } } 

Database and Testing

object ProductsTable : LongIdTable("products") { val name = varchar("name", 255) val slug = varchar("slug", 255).uniqueIndex() val price = decimal("price", 10, 2) val categoryId = long("category_id").nullable() val isActive = bool("is_active").default(true) val createdAt = timestamp("created_at").defaultExpression(CurrentTimestamp) } class ProductRepository(private val db: Database) { suspend fun findAll(page: Int, limit: Int, categoryId: Long?): Pair<List<Product>, Long> = db.dbQuery { val query = ProductsTable .leftJoin(CategoriesTable, { ProductsTable.categoryId }, { CategoriesTable.id }) .select { ProductsTable.isActive eq true } .apply { if (categoryId != null) andWhere { ProductsTable.categoryId eq categoryId } } val total = query.count() val products = query .orderBy(ProductsTable.createdAt to SortOrder.DESC) .limit(limit, offset = ((page - 1) * limit).toLong()) .map { toProduct(it) } products to total } } suspend fun <T> Database.dbQuery(block: () -> T): T = withContext(Dispatchers.IO) { transaction { block() } } class ProductRouteTest { @Test fun `GET products returns paginated list`() = testApplication { application { configureApplication() // Replace dependencies with mocks } val response = client.get("/api/v1/products?page=1&limit=10") assertEquals(HttpStatusCode.OK, response.status) val body = Json.decodeFromString<Map<String, Any>>(response.bodyAsText()) assertNotNull(body["data"]) assertNotNull(body["pagination"]) } @Test fun `POST products returns 401 without token`() = testApplication { application { configureApplication() } val response = client.post("/api/v1/products") { contentType(ContentType.Application.Json) setBody("""{"name": "Test", "price": 10.0}""") } assertEquals(HttpStatusCode.Unauthorized, response.status) } } 

What's Included?

• Full source code with comments in English and ReadMe documentation
• API specification in OpenAPI (Swagger) for frontend integration
• Configured CI/CD (GitLab CI or GitHub Actions) with automated deployment
• Deployment and operation manual
• Support for 2 weeks after delivery
• Basic packages starting from $15,000, with typical savings on server costs of $2,000/month

Our team has 5+ years of experience with Kotlin and Ktor, and we have delivered over 50 projects using Ktor and Kotlin Multiplatform. Get a consultation and a backend prototype in 3 days — contact us.