API Glossary

• API Key - A secret string issued by an API provider that identifies the calling application. Sent with each request to authenticate and meter usage. Treat like a password.
• Endpoint - A specific URL where an API receives requests, e.g. https://api.example.com/v1/customers. Each endpoint typically maps to one resource and HTTP method.
• OAuth - An authorization framework (commonly OAuth 2.0) that lets a user grant a third-party app scoped access to their account without sharing their password, by issuing short-lived access tokens.
• JWT - JSON Web Token - a compact, signed token format (header.payload.signature) used to carry claims such as identity and expiry. Supabase and Firebase use JWTs for auth.
• Webhook - An HTTP callback where the API provider POSTs event data to a URL you register when something happens, instead of you polling for updates.
• REST - Representational State Transfer - an architectural style for APIs that exposes resources as URLs accessed with standard HTTP verbs (GET, POST, PUT, PATCH, DELETE), usually returning JSON.
• GraphQL - A query language for APIs where a client sends a single query describing exactly the fields it wants, and the server returns that precise shape from a typed schema.
• SDK - Software Development Kit - a language-native library that wraps an API, handling authentication, serialization, retries, and typed responses so developers do not call raw HTTP.
• Pagination - Splitting a large list of results into smaller pages. Common styles are offset (?offset=0&limit=50), cursor (opaque token), and page-based (?page=2).
• Rate Limit - The cap on how many requests a client may make per time window. Exceeding it returns HTTP 429. Manage with caching, backoff, and respecting Retry-After.