API development

API: how your service talks to other systems

API development — REST, GraphQL, or tRPC-based, documented, versioned, and tested. Public API, internal API, or partner API.

OpenAPI / GraphQL schema specs, automatic SDK generation, rate limiting, authentication, monitoring — end-to-end professional API delivery.

Start an API project All services

Standard for API development delivery

REST + OpenAPI 3 spec
GraphQL + schema-first design
tRPC (TypeScript end-to-end)
Auth: OAuth, API key, JWT
Rate limit + caching + monitoring

01.

REST, GraphQL, tRPC — which?

REST is the most widespread, most mature, most documented type. Standard pick for public APIs. Documented via OpenAPI 3 spec; SDK generation is automatic.

GraphQL: client picks exactly which fields it wants; solves over-fetching and under-fetching. Right for shared data needs across mobile + web.

tRPC: fastest path for full-stack TypeScript projects. End-to-end type safety; no SDK generation needed since TypeScript itself is the SDK.

02.

API design principles

Resource-based URLs (REST) or schema-first design (GraphQL), consistent naming convention, pagination, filtering, sorting standardization, error format consistency (RFC 7807 problem details), versioning strategy (URL path or header).

These aren't 'details'; they shape the 5–10-year usability of your API. Badly designed APIs need breaking changes later, which annoys your users.

03.

Auth and security

API auth options: OAuth 2.0 (third-party access), API key (server-to-server), JWT (user-scoped short-lived), session-based (browser). We pick by use case.

Rate limiting (per-user, per-IP, per-endpoint), correct CORS, input validation (Zod), SQL injection prevention, secrets rotation — security basics.

04.

Documentation and developer experience

API success depends on developer experience. Auto-generated docs via OpenAPI 3 (REST) or GraphQL schema. Interactive docs via Swagger UI / GraphQL Playground / tRPC docs.

SDK generation (TypeScript, Python, Go) is automatic. Postman collection, code samples, getting-started guide — part of the standard package.

Frequently asked questions

Public API or internal API?

Public APIs (offered to your customers) need higher quality: documentation, SDK, monitoring, support. Internal APIs (inside the company) can be more flexible.

How is API versioning done?

URL-based (/v1, /v2) or header-based (Accept: application/vnd.api+json;v=2). Standard is URL-based for public. On breaking change, old version stays deprecated for a year then retires.

How are rate limits set?

Per-user (logged-in), per-IP (anonymous), per-endpoint (critical vs. not). Typical: 100 req/min anonymous, 1,000 req/min authenticated. Tier-based growth.