What Is an API in Plain English?
Common questions about APIs answered in plain language — what they do, how they work, why they matter, and how they power every app you use.
APIs power every app you use — from weather forecasts to payment processing. But what exactly is an API? Here are common questions answered in plain language.
What does API stand for?
API stands for Application Programming Interface.
Break it down:
An API is how one piece of software asks another piece of software to do something. It's a contract: "If you send me this request in this format, I'll send you back this response."
What does an API actually do?
An API lets software communicate with other software without needing to know how it works internally.
Real-world analogy:
Think of a restaurant. You (the customer) don't walk into the kitchen and start cooking. You tell the waiter what you want from the menu. The waiter takes your order to the kitchen, the kitchen prepares it, and the waiter brings it back to you.
In this analogy:
You don't need to know how the kitchen works. You just use the interface (the waiter/menu) to get what you need.
Want to see how APIs fit into web requests? Check out The Journey of a URL.
How do web APIs work?
Most APIs you encounter are web APIs (also called HTTP APIs or REST APIs). Here's the flow:
- The HTTP method (GET to fetch data, POST to send data, etc.)
- Headers (metadata like authentication tokens)
- Sometimes a body with data you're sending
- A status code (200 = success, 404 = not found, etc.)
- Data in a structured format, typically JSON
Example API request:
GET https://api.weather.com/forecast?city=Seattle
Authorization: Bearer YOUR_API_KEY
Example response:
{
"city": "Seattle",
"temperature": 58,
"condition": "Cloudy",
"forecast": "Rain likely"
}
Your app receives this JSON, parses it, and displays it to the user: "Seattle is 58° and cloudy."
Dive deeper: What Is an API? — interactive lesson on how APIs work.
What is JSON and why do APIs use it?
JSON (JavaScript Object Notation) is a lightweight text format for structuring data. Despite the name, every programming language can read and write JSON.
Why APIs love JSON:
JSON example:
{
"user": {
"name": "Alice",
"email": "alice@example.com",
"active": true
},
"posts": [
{"title": "Hello World", "likes": 42},
{"title": "Learning APIs", "likes": 137}
]
}
Keys are strings in double quotes. Values can be strings, numbers, booleans, objects (curly braces), or arrays (square brackets).
Learn more: What Is JSON? — the universal language of APIs.
Why do APIs matter?
APIs enable reusability and specialization. Without APIs, every app would need to build everything from scratch.
Examples of what APIs let you do:
APIs let companies focus on their core product while leveraging external services for the rest. They're the building blocks of modern software.
What's an API key and why do I need one?
An API key is a secret token that proves you have permission to use an API.
Why APIs require keys:
How it works:
When you sign up for an API, the provider gives you a unique key. You include it in every request:
GET https://api.example.com/data
Authorization: Bearer your_api_key_here
Without the key, the API refuses your request (usually with a 401 Unauthorized response).
Security warning:
API keys are secrets. Never commit them to public code repositories. Use environment variables instead.
Related: Environment Variables Explained — keeping secrets out of code.
What's the difference between public and private APIs?
Public APIs (also called open APIs or external APIs):
Private APIs (also called internal APIs):
Partner APIs:
Most APIs you hear about are public. Most APIs that exist are private (companies build internal APIs constantly).
Can I use any API for free?
It depends. APIs have different pricing models:
Free tiers:
Many APIs offer free usage up to a limit. Examples:
Paid tiers:
Once you exceed free limits, you pay per request, per user, or via subscription. Pricing varies wildly:
Fully free APIs:
Some APIs are entirely free with no limits:
Before integrating:
Check the API's pricing page. Free tiers can disappear or change. Budget for scaling — 100 requests a day becomes expensive at 10,000,000 requests a day.
What happens when I exceed rate limits?
Most APIs enforce rate limits — caps on how many requests you can make in a time window (e.g., 1,000 requests per hour).
When you exceed the limit:
The API returns a 429 Too Many Requests status code. Your request is rejected. You must wait until the rate limit window resets.
Why rate limits exist:
How to handle rate limits:
Most APIs include rate limit info in response headers:
X-RateLimit-Limit: 1000
X-RateLimit-Remaining: 237
X-RateLimit-Reset: 1630000000
Good clients:
Learn more: Rate Limiting Explained — why APIs throttle requests.
What's the difference between REST and GraphQL?
REST (Representational State Transfer):
The traditional API architecture. Each endpoint represents a resource:
GET /users/123 → Get user data
GET /users/123/posts → Get user's posts
POST /posts → Create a new post
You get what the endpoint returns — no customization. Need more data? Make more requests.
GraphQL:
A query language for APIs. You describe exactly what data you want in one request:
{
user(id: 123) {
name
posts {
title
likes
}
}
}
The server returns only the fields you requested. One request can fetch data from multiple resources.
Trade-offs:
REST is simpler and more cacheable. GraphQL reduces round trips and gives clients flexibility. Many modern APIs offer both.
How do I find an API's documentation?
API documentation (often just called "docs") explains:
Where to look:
- https://stripe.com/docs/api
- https://docs.github.com
Good docs include:
Poor docs are vague, outdated, or incomplete. If the docs are bad, the API is probably bad too.
What is REST?
REST stands for Representational State Transfer — a set of architectural principles for designing web APIs.
Key REST principles:
- GET = Read
- POST = Create
- PUT/PATCH = Update
- DELETE = Delete
RESTful API example:
GET /users → List all users
GET /users/42 → Get user 42
POST /users → Create a new user
PUT /users/42 → Update user 42
DELETE /users/42 → Delete user 42
REST isn't a strict standard — it's a style. Most modern web APIs are "REST-ish" but don't follow every principle religiously.
Related: HTTP Status Codes Decoded — understanding response codes.
Are APIs secure?
APIs can be secure or insecure — it depends on how they're built and used.
Common security measures:
Common vulnerabilities:
Best practices:
Security reading: What That Padlock Really Means — HTTPS encryption basics.
How do I start using an API?
Step-by-step:
curl -H "Authorization: Bearer YOUR_API_KEY" \
https://api.example.com/data
const response = await fetch('https://api.example.com/data', {
headers: {
'Authorization': 'Bearer YOUR_API_KEY'
}
});
const data = await response.json();
console.log(data);
Start simple: Try a free, public API first. Experiment, break things, and learn how requests and responses work.
Quick Reference
| Term | What it means |
|------|---------------|
| API | Application Programming Interface — how software talks to software |
| Endpoint | A specific URL where an API accepts requests (e.g., /users) |
| REST | Architectural style for web APIs using HTTP methods and resources |
| JSON | Lightweight data format APIs use to send structured data |
| API key | Secret token proving you have permission to use an API |
| Rate limit | Maximum number of requests allowed in a time window |
| HTTP methods | GET (read), POST (create), PUT (update), DELETE (remove) |
| Status code | Three-digit response code (200 = success, 404 = not found) |
The Takeaway:
APIs are contracts that let software communicate. They power every app by enabling reusability — instead of building everything from scratch, you integrate with services via their APIs. Whether fetching weather data, processing payments, or sending emails, APIs are the glue that makes modern software work.
Understanding APIs means understanding how the digital world connects.
Related Reading:
*This post is part of Hacking Bits, where we explain how everyday technology works — one bit at a time.*
Related Posts
What Is DNS? A Plain-English Q&A
Common questions about DNS answered in plain language — recursive vs authoritative servers, TTL and caching, how nameservers work, and why they matter when you visit a URL.
Checklist: Do You Actually Need a CDN?
A practical checklist to understand what CDNs do, what they cache, when they help, and whether your site needs one.
Git Branch vs Commit: What's the Difference?
Branches and commits are both fundamental to git — but they work in completely different ways. Here's what each one does and why it matters.