Skip to content

API

Understand APIs — how applications talk to each other, and how REST APIs structure requests and responses.

What you'll learn

  • What an API is and why they exist
  • How REST APIs use HTTP methods on resources
  • What an endpoint is and how to call one
  • How authentication protects API access

Concept

API

An API (Application Programming Interface) is a set of rules that lets one piece of software talk to another. Instead of a user clicking buttons, a *program* sends requests and receives data. When a weather app shows the forecast, it called a weather API to get the data.

REST APIs

REST (Representational State Transfer) is the most common API style on the web. A REST API treats everything as resources identified by URLs, and uses HTTP methods to act on them:

| Method + URL | Action | |--------------|--------| | GET /users | List all users | | GET /users/42 | Get one user | | POST /users | Create a user | | PUT /users/42 | Replace user 42 | | DELETE /users/42 | Delete user 42 |

This mapping — HTTP methods onto CRUD operations (Create, Read, Update, Delete) — is the heart of REST.

Endpoints

An endpoint is a specific URL the API exposes. https://api.example.com/users is an endpoint. The combination of endpoint + method defines one operation. Documentation lists all available endpoints, their parameters, and their response shapes.

Calling an API

const response = await fetch("https://api.example.com/users/42", {
  headers: { "Authorization": "Bearer my-token" }
});
const user = await response.json();

Authentication

Most APIs require authentication — proof you are allowed to access them. Common methods:

  • API keys — a secret string sent in a header or query param.
  • Bearer tokens / JWTs — a signed token proving your identity and permissions.
  • OAuth — a protocol that lets a user grant a third party access without sharing their password.

Without authentication, anyone could read or modify any user's data. Understanding how to authenticate is essential for working with real APIs.

Example

              // Calling a REST API to list and create users
const API_BASE = "https://api.example.com";
const token = "your-api-token";

// GET: list users
async function listUsers() {
  const res = await fetch(`${API_BASE}/users`, {
    headers: { "Authorization": `Bearer ${token}` }
  });
  return res.json();
}

// POST: create a new user
async function createUser(name, email) {
  const res = await fetch(`${API_BASE}/users`, {
    method: "POST",
    headers: {
      "Authorization": `Bearer ${token}`,
      "Content-Type": "application/json"
    },
    body: JSON.stringify({ name, email })
  });
  if (!res.ok) throw new Error(`Failed: ${res.status}`);
  return res.json();
}

Both calls use the Authorization header with a bearer token. GET has no body; POST sends JSON. Checking res.ok ensures we throw on failure instead of silently returning an error object.

Try it

  • JWT Decoder

    APIs often use JWTs for auth. Decode one to see the claims (user ID, expiry, roles).

  • JSON Schema Validator

    APIs define response shapes with JSON Schema. Validate a response against one.

Common mistakes

The mistake

Hardcoding API keys in client-side code.

The fix

Client-side code is visible to everyone. Keep API keys on a server or behind a proxy. If you must include a key client-side, use one with restricted permissions and rate limits.

The mistake

Assuming fetch() throws on a 404 or 500.

The fix

fetch only rejects on network failure. HTTP errors (4xx, 5xx) still resolve — you must check response.ok or response.status and throw manually.

Related Resources

Related Guides

Practice API

2 exercises

Practice API

Look up unfamiliar terms

A beginner-friendly glossary explains jargon in plain English — variables, functions, DOM, Promise, and more.

View glossary

Build real projects

Apply what you learned by building guided projects with starter code and solutions.

View projects

Decode error messages

Plain-English explanations of common errors — what they mean, why they happen, and how to fix them.

View errors