An API (Application Programming Interface) is a fixed set of rules that lets one software program use the data or functions of another program, without a human in between. In simple terms: where a user interface is meant for people, an API is meant for software.
An API works with requests and responses: software sends a request to a fixed address and gets data or a confirmation back.
An API integration connects two systems through their APIs, so that data moves across automatically instead of through an export or retyping. Integrations like these form the basis of AI agents and automation in the office.
Access is granted through an API key or token. Who manages those keys and what permissions they grant is a question for the organisation, not just for the supplier.
What does API stand for?
API stands for Application Programming Interface: a set of functions and rules that lets software communicate with a program. MDN, Mozilla’s documentation, describes an API as a contract between the program that offers the API and the software that uses it.
That contract sets out which requests a program accepts, in which format, and what it sends back. As long as both sides stick to it, the exchange works, whatever programming language the software is written in.
How does an API work?
An API works with a request and a response: software sends a request to an endpoint, a fixed web address for one kind of data or action, and receives a response.
An example: a quoting tool requests a client’s contact details through the CRM’s API. The CRM then checks whether the tool is allowed to access them and sends back the name, address and email address.
- Method
- Address
- Key
- Content
- Data: name, address, email
- Status code, such as 200
Language models can be reached in the same way. Through the Claude API, I send texts to Claude from Python scripts on my VPS and get the result back in my own workflow.
What do you send to an API?
You send an API a request with four parts: a method, an address, your key and, if needed, content. The method indicates the kind of request: GET retrieves data, while POST sends data and often changes something on the server side.
The content is usually in JSON, a lightweight, text-based format that, according to the RFC 8259 standard, is independent of any programming language. JSON records data as pairs of names and values, for example a field client_name with the client’s name as its value.
What do you get back from an API?
An API sends back data plus a status code that shows whether the request succeeded. Five status codes come up often:
- 200: the request succeeded and the response contains the requested data.
- 401: authentication is missing or invalid, usually because of a wrong or expired key.
- 404: the requested address or record does not exist.
- 429: too many requests in a short time, because the API applies rate limiting.
- 500: something went wrong on the server side.
In a production workflow on my VPS, I ran into rate limits during bulk analyses through the Claude API. My scripts therefore wait after a 429, a 500 or an overloaded server, and then try again.
What is a REST API?
A REST API is an API that follows the REST (Representational State Transfer) architectural style, which works with ordinary web addresses and the standard HTTP methods. Roy Fielding described REST in 2000 in his doctoral dissertation at the University of California, Irvine.
In a REST API, each kind of data has its own address, such as one address for clients and one for invoices. GET lets you read, POST lets you create something; the response usually comes in JSON.
SOAP is an older protocol with strict XML messages. GraphQL is a query language that lets the requester decide which fields come back.
What is an API integration?
An API integration is a connection between two systems that exchange data automatically through their APIs. A new client in the CRM then ends up in the accounting software automatically, without anyone retyping the details.
Without an integration, there are two alternatives. With export and import, you put data in a file, often a CSV, and load that file into the other system. With retyping, an employee does it by hand.
An export gives you a snapshot; an integration keeps both systems in sync without manual work.
What are the benefits of an API integration?
An API integration has five benefits over exporting or retyping:
- Up-to-date data: information is in both systems straight away, rather than only after the next export.
- Fewer typing errors: no swapped digits, missing fields or misspelled names from manual work.
- A single source: each piece of data is entered and managed in one place, after which the integration distributes it.
- Traceability: every request can be logged, so you can see afterwards who changed what.
- A basis for automation: AI applications and no-code tools work with the same APIs to take over tasks.
An integration does make you dependent on the provider. If they change their API, the integration stops working until someone updates it.
How do you get access to an API?
You get access to an API with a key or token that proves who is making the request and which permissions apply. A request without a valid key or token usually gets status code 401 back.
What is an API key?
An API key is a long secret code that you create with the provider and that your software sends with every request. There is no general standard for it; each provider decides how its keys work.
Whoever holds the key acts on behalf of the account it is linked to. A leaked key therefore gives an outsider the same access, and with a paid API the costs end up on your bill.
What is an API token?
An API token is usually an access token: under the OAuth 2.0 standard (RFC 6749, October 2012), a string that represents a granted authorisation, with a defined scope and lifetime. So a token expires, whereas a key often keeps working until you revoke it.
OAuth is the framework that lets you give an application limited access to your account without sharing your password. The application gets a token with only the permissions you have approved.
How do you manage API keys within an organisation?
You manage API keys within an organisation with a fixed owner, limited permissions and a procedure for revoking them. Five rules cover most of the risk:
- Create a separate key for each application, so that a leak only means shutting down that one integration.
- Give each key only the permissions the integration uses, for example read access without write access.
- Share keys through a password manager, never by email, chat or a shared document.
- Revoke keys immediately when an employee leaves or a key has been exposed publicly.
- Keep a record of which key belongs to which integration and which employee.
In my own automations, security comes first: what data goes in, where it ends up and who has access to it. An API key is exactly the point where those three questions meet.
What is the difference between an API and a webhook?
An API and a webhook differ in who takes the initiative. With an API, your software asks for data; with a webhook, the other system sends a message itself as soon as something happens.
Without a webhook, software checks at fixed intervals whether there is anything new; this is called polling. A webhook makes polling unnecessary, although after a notification you often still retrieve the details through the API.
What is the difference between an API and MCP?
An API and MCP differ in scope: each provider’s API has its own rules, whereas MCP is a single open standard that lets an AI application connect to all kinds of systems in the same way.
Through MCP (Model Context Protocol), an AI assistant talks to an MCP server, and that server in turn often calls the software’s existing API. So MCP does not replace APIs, but makes them usable for AI applications without a custom integration for each combination.
Do you need to know how to code to use an API?
No, you do not need to code to use an API. No-code tools such as Zapier, Make and Power Automate hide the requests behind blocks that you click together.
For anything beyond what those tools can do, you can have a language model write the code. I build my own automations with AI as a building partner and test the code by running it.
Does every software package have an API?
No, not every software package has an API, and an existing API does not always cover all the data. You can recognise an API by developer documentation, a page listing integrations or a setting where you create API keys.
If there is no API, an export is the only option left. I apply that limit to my own automations: a process only qualifies if the source system has an API or an export.
Frequently asked questions about APIs
Besides how an API integration works, questions about documentation and connecting a website often come up in practice.
What is in API documentation?
API documentation sets out, for each endpoint, what you send and what you get back, including the status codes and how you authenticate with a key or token. A provider can describe its API according to the OpenAPI Specification, a standard that defines an HTTP API independently of any programming language. A language model can set up an integration from such a description, provided you test the code before it runs with real data.
What is the difference between an API and an SDK?
An API is the set of rules that lets software communicate with a service; an SDK is a package of ready-made code that calls that API for you in a particular programming language. Anthropic, for example, offers official SDKs for Python, TypeScript, Java and Go, among others, with built-in support for retrying failed requests. With an SDK you write less code, but under the bonnet it sends the same API requests.
How do you connect a website through an API?
You connect a website through an API by having the CMS or online shop exchange data with another system, such as a CRM or accounting software. WordPress has its own REST API for this, which lets other software read or create site content through JSON. Since version 5.6, you can create application passwords in your WordPress user profile, which software sends with requests over https instead of your normal password.
How do you learn to build an API integration with AI?
You learn it by starting from one recurring task, with a language model’s API as the link. In the AI Automation Course, you make your first API call, create an API key securely and handle errors and rate limits.
If you prefer to work without code, the same course shows you how to connect Claude through Make or Zapier. That way you see in practice how an API integration works: key, request, status code and response.
