When I started building backend services, the biggest mistake I made was putting everything in one giant controller. It works for a demo, but as soon as the API grows, it becomes a nightmare to maintain. The fix is a clear layered architecture: Controller → Service → Repository.
Controllers should only handle HTTP concerns — parsing requests, validating input, and returning responses. All business logic belongs in the service layer, and data access stays in repositories. This separation makes your code testable and lets you swap implementations without touching the API surface.
Another habit I swear by is using DTOs instead of exposing entities directly. Entities carry persistence concerns (lazy loading, internal fields) that should never leak to the client. Map entities to DTOs at the boundary, and your API contract stays stable even when the database schema changes.
Finally, don't forget global exception handling. A single @RestControllerAdvice that maps exceptions to consistent error responses saves hours of debugging for frontend teams — and makes your API feel professional.