What is API?

An API (Application Programming Interface) is a set of rules that defines how two pieces of software exchange information. It exposes a system’s functionality without revealing how that system is built on the inside — the digital equivalent of a restaurant menu: you order a dish by name without needing to know how the kitchen works.

That separation is what makes an API valuable. Consumers depend only on the contract (what data to send, what data comes back), not on the implementation. The team maintaining the API can rewrite the entire database behind it and, as long as the contract stays the same, nothing breaks on the consumer’s side.

How an API works in practice

On the web, most APIs run over HTTP. The client sends a request to an address (the endpoint), the server processes it and returns a response — almost always in JSON. Each request carries a method that signals the intent: fetch, create, update or delete.

Notice that the response is structured: predictable keys and values that any language can parse. That is what makes it possible to build a mobile app, a website and an internal dashboard all consuming exactly the same API.

The most common types of API

• REST — the dominant standard on the web. It uses HTTP methods and treats each resource as a URL. See the REST API entry.
• GraphQL — the client describes exactly the fields it wants and receives only that, in a single request. Details in GraphQL.
• WebSocket — keeps the channel open in both directions, for chat, notifications and real-time data.
• Webhook — flips the logic: instead of you asking, the server notifies you when something happens. See Webhook.
• SOAP — based on XML and rigid contracts; still common in banks, insurance companies and legacy systems.

Authentication: who gets to call

Open APIs accept any request, but most require identification. The most common mechanisms are the API key (a key sent in a header), OAuth 2.0 (the user authorizes an app to act on their behalf without handing over their password) and JWT, a signed token that carries the session data. You can inspect a token’s contents with the JWT decoder.

Where APIs show up in everyday life

Paying with Pix (Brazil’s instant payment system), seeing the map inside a delivery app, signing in with your Google account, getting an order confirmation on WhatsApp — all of these flows are API calls happening behind the scenes. To see it working in concrete terms, check out our tutorials on the Google Maps API, the Facebook Graph API and the Cowsay API.