Tap the menu to see every request this app's server will accept.

An API is the server's menu: the fixed list of things you're allowed to ask it for.

Tap the button, then tap each stop

What the server can see

Your email and password, briefly, in memory — this is where the app checks them, hashes the password, and decides what you're allowed to do. Secrets that live HERE stay private.

That list is the server's API: the menu of requests it understands, what each one needs, and what you get back.

MDN: an API (Application Programming Interface) "is a set of features and rules that exist inside a software program (the application) enabling interaction with it through software." Software ordering from software.

Each item on the menu is an endpoint: an address plus a verb. "POST to /signup with an email and password" is one endpoint.

A tiny API menu

POST /signup

You send
An email and a password
You get back
A new account, or an error

GET /orders

You send
Who you are (a login token)
You get back
Your orders, and only yours, if the kitchen checks

POST /admin/refund

You send
An order number
You get back
A refund, which is why it needs the strictest check

Your app orders from other kitchens too. Adding AI means calling OpenAI's or Anthropic's API; taking payments means Stripe's.

An API key is how those kitchens know whose tab to charge. Whoever holds your key orders on your bill, which is why keys stay on your server (more here).

The menu is public in practice. Anyone can order anything on it, as often as they like. The kitchen has to decide who gets served.

Try it with the rules off. In the sandbox, order straight from the menu without the app: pick an endpoint and change what you send. See which ones the kitchen refuses.

Check yourself

0/4 got it

Saved on this device only. No account, no streaks.

Next in the journey of a tap: Frontend vs backend.