Application Programming Interface

Programs often need to ask each other for something. A weather app wants temperature data from a large weather service, a checkout at a supermarket wants to know whether a credit card is covered. For this to work without humans asking questions back and forth, fixed rules are needed: Which request is allowed, what information must it contain, what does the response look like? Exactly these rules are called an application programming interface, abbreviated API. You can picture it like a menu at a restaurant: it tells you what you’re allowed to order, and reveals nothing about how the food is cooked in the kitchen.

Why almost every app depends on foreign interfaces

Hardly any program does everything itself today. A travel app shows maps from a mapping service, handles payment through a payment provider, and sends confirmations via a mail provider. Each of these building blocks comes into play via an interface. This saves years of development work, since you don’t have to build your own world map or your own bank.

For companies, interfaces are therefore also a business model. Whoever offers a good API doesn’t sell a program, but access to it, usually billed per request. In the AI industry, this is the norm: the large language models run in the providers' data centers, and other companies pay to use them via an interface. Such figures regularly show up in quarterly reports.

The downside is dependency. If a provider changes its interface or raises prices, everyone building on it has to follow suit. There are cases where companies have made access to their API much more expensive, and many apps built on top of it disappeared as a result. Whoever deeply embeds a foreign interface into their product gives up a piece of control.

Request, response, and the key in between

In the most common case, this happens over the internet. A program sends a request to a specific address, similar to a web address, and attaches its information. The server responds with data in a fixed format, usually JSON, i.e. structured text that programs can easily take apart. A response also contains a status code, for example 200 for success or 404 for not found.

This almost always includes an API key. This is a long string of characters that, like a password, proves who is making the request. It is used for billing and to limit how many requests per minute are allowed. This limit is called a rate limit; it protects the provider from overload. A key should never end up in a public app or on a website, otherwise anyone can make requests at someone else’s expense.

What matters is the separation between the interface and the inner workings. As long as the agreed format of the requests stays the same, the provider is free to completely rebuild the software behind it. This is exactly what makes interfaces so useful. That’s why documentation always includes a version number, so that old programs keep working.

Where you encounter the word API

In everyday life, you usually only notice interfaces when they fail. If a map suddenly stops loading in an app, or a payment doesn’t go through, a disrupted third-party interface is often behind it. Even the “Sign in with Google” login button is an interface call.

In the news, you mainly encounter the term in two contexts. First, with AI providers making new models “available via API” and naming prices per million processed text units. Second, in disputes over data access, for example when social networks block researchers or competitors from the interface. A related term is the SDK, a ready-made toolkit package that makes working with an interface easier in a particular programming language.