Learn the (req, res, next) signature, use built-in middlewares, write a logger, write auth, write validation, learn error handling, learn async error handling, add security middlewares, add logging, add performance, apply per-router, compose per route, and test.

After you can write a custom middleware (auth or validation). Error handling needs the four-parameter signature and a custom ApiError class. It is a small step once you know the basic pattern.

After you understand the basics and have written auth. Add helmet, cors, express-rate-limit, express-mongo-sanitize, xss-clean, and hpp. Most are one-liners with big payoff.