All posts
5 min read

What Is an API? Explained Without the Jargon

APIs are how apps talk to each other — how your app takes a payment, sends an email, or asks an AI model a question. What an API actually is, what requests and responses look like, what an API key does, and the few terms you'll keep running into.

getting startedno-codearchitecturebeginner

If you build anything with AI tools, you'll hit the word API within a day. "Connect to the Stripe API." "Add your OpenAI API key." "The API returned an error." It sounds technical, but the idea is simple.

The one-sentence version

An API (Application Programming Interface) is a defined way for one piece of software to ask another piece of software to do something.

That's it. When your app takes a payment, it asks Stripe's API. When it sends an email, it asks an email service's API. When it answers a question with AI, it asks an AI provider's API.

The restaurant menu

A menu is a good picture of an API.

  • It lists what you can ask for — the dishes.
  • It tells you how to ask — by name, maybe with options ("medium rare").
  • It tells you what you'll get back.
  • You don't need to know how the kitchen works to order.

An API is a menu for software. It says: here are the things you can ask this service to do, here's exactly how to ask, and here's what you'll get back.

What asking looks like: requests and responses

Most APIs you'll meet are web APIs. Your app sends a request over the internet to a URL, and gets a response back.

A request has a few parts:

  • The URL (endpoint) — the address of the thing you want, like https://api.example.com/v1/weather.
  • The method — what kind of action. The common ones:
    • GET — fetch something ("show me the weather")
    • POST — create something ("send this email")
    • PUT / PATCH — change something
    • DELETE — remove something
  • Data — details for the request, usually written as JSON (like {"city": "Lisbon"}). JSON is just a tidy text format for data — see What Is JSON?.
  • Headers — extra information, including who you are (your API key).

The response comes back with:

  • A status code — a number saying how it went.
  • Data — usually JSON, like {"temperature": 24, "conditions": "sunny"}.

Status codes you'll see

You don't need to memorise them, but these come up constantly:

Code Means
200 OK — it worked
201 Created — your new thing was made
400 Bad request — something in what you sent was wrong
401 Unauthorised — missing or invalid API key / not logged in
403 Forbidden — you're known, but not allowed to do this
404 Not found — wrong URL, or the thing doesn't exist
429 Too many requests — slow down, you've hit a rate limit
500 Server error — something broke on their side

Rule of thumb: 4xx means the problem is probably in your request; 5xx means the problem is on the server. That alone speeds up debugging a lot. (How to Read an Error Message has more.)

What's an API key?

Many APIs need to know who's asking — to bill you, to limit how much you use, and to keep strangers out. An API key is a long secret string that identifies your account. You include it with each request.

Treat an API key like a password and a credit card:

  • Anyone who has it can use the service as you, at your expense.
  • It must never be in your frontend code, pasted in a chat, or committed to GitHub.
  • It belongs in a backend environment variable — see What Is an Environment Variable?.

Some services give you two keys: a public (or publishable) one that's safe in the browser, and a secret one that isn't. The names usually make it clear. When in doubt, assume it's secret.

Your app has an API too

APIs aren't only for talking to other companies. Your own app probably has one: your frontend asks your backend for data through your API — GET /api/orders, POST /api/login. (That's the waiter between the dining room and kitchen in Frontend vs Backend.)

Which leads to one important point: your API is public. Anyone can send requests to it, not just your frontend. So every endpoint has to check who's asking and whether they're allowed. Hiding a button in your app doesn't hide the API behind it.

A few more terms you'll hear

  • REST — a common style of designing web APIs around URLs and methods like GET and POST. Most APIs you'll use are "RESTful."
  • Endpoint — a specific URL on an API, like /v1/customers.
  • SDK — a library a company provides so you can call their API with simple code instead of writing requests by hand. stripe.customers.create(...) is an SDK calling Stripe's API for you.
  • Webhook — an API call in reverse: the other service calls you when something happens. See What Is a Webhook?.
  • Rate limit — a cap on how many requests you can make in a period. Exceed it and you'll get a 429.
  • Documentation ("docs") — the menu. Every good API has docs explaining its endpoints. When your AI tool gets an API wrong, pasting the relevant docs page into the chat often fixes it.

The summary

  • An API is a defined way for software to ask other software to do things.
  • You send a request (URL, method, data, key) and get a response (status code, data).
  • 4xx = your request; 5xx = their server.
  • API keys are secrets. Backend only, never in the browser, never in git.
  • Your own app's API is public, so it must check permissions on every request.

EasySpawn runs your app's backend on a real server, so API keys live in server-side environment variables and your own API can check every request. See how it works for AI-built apps or join the waitlist.

Related: Frontend vs Backend · What Is a Webhook? · HTTP Status Codes Explained · GraphQL vs REST · What Is CRUD?

Keep reading