🍽️ APIs

API = Application Programming Interface

A way for software to talk to other software.

Your app → API → Another system's data/functionality
                 ↓
              Response back to your app

Interface = standardized way to interact.

TV remote: Standard buttons (power, volume, channel)
USB port: Standard connection
API: Standard ways to request and receive data

You don't need to know how it works inside.

Over the internet. HTTP-based.

Your app → HTTP request → Server
Your app ← HTTP response ← Server

REST, GraphQL, SOAP

In your code. Function calls.

import pandas
df = pandas.read_csv("data.csv")

pandas provides an API for data manipulation.

Your code talks to the OS.

file.open("document.txt")

OS provides file system API.

Software talks to hardware.

camera.capture()

Camera provides an API for taking photos.

Client sends request:
  - URL: Where to send it
  - Method: What to do (GET, POST, etc.)
  - Headers: Metadata (auth, content type)
  - Body: Data (for POST, PUT)

Example:
  GET https://api.weather.com/current?city=Sydney
  Authorization: <credentials>

Server sends response:
  - Status code: Did it work?
  - Headers: Metadata
  - Body: The actual data

Example:
  200 OK
  { "temperature": 25, "condition": "sunny" }

Connect different systems.

Your e-commerce site → Stripe API → Payment processing
Your app → Google Maps API → Maps and directions
Your site → SendGrid API → Email sending

Get data from external sources.

Twitter API → Tweets
Weather API → Forecasts
Stock API → Prices

Use features you didn't build.

Twilio API → Send SMS
OpenAI API → AI completions
AWS S3 API → Store files

Travel booking site:
  → Airline APIs (flight availability)
  → Hotel APIs (room availability)
  → Car rental APIs (car availability)
  → Payment APIs (process payment)

One website, many APIs behind the scenes!

Uses HTTP methods and URLs.
Stateless.
Resources-focused.

GET /users/123
POST /users
DELETE /users/123

Query language.
Ask for exactly what you need.
Single endpoint.

{ user(id: 123) { name, email } }

XML-based. Enterprise.
Strict contracts (WSDL).
Older, but still used in banking/enterprise.

Real-time, bidirectional.
Server can push to client.
Chat, live updates.

Simple. One key per app.

Authorization: ApiKey your-key-here

Easy to implement. Share carefully.

User authorizes your app.
App gets token to act on user's behalf.

"Log in using Google"

Token contains user info.
Signed. Self-contained.

Authorization: <token>

APIs limit how often you can call.

100 requests per minute.
Exceed? 429 Too Many Requests.

Be a good API citizen!

Good API documentation includes:
  - Available endpoints
  - Request format
  - Response format
  - Authentication method
  - Error codes
  - Examples

OpenAPI/Swagger is common standard.

You use someone else's API.

Read the docs.
Get credentials.
Make requests.
Handle responses.

You create an API for others.

Design endpoints.
Implement logic.
Document it.
Handle errors gracefully.

✓ Handle errors gracefully
✓ Respect rate limits
✓ Cache responses when appropriate
✓ Keep credentials secret
✓ Read the documentation

✓ Use consistent naming
✓ Return helpful error messages
✓ Version your API
✓ Document everything
✓ Validate input

API returns error → App crashes.

Make sure your app handles error responses.

API key in source code → Security risk!

Use environment variables.

"Why doesn't this work?"

Read. The. Documentation.

Hammering API → Get blocked.

Implement backoff and respect limits.