API (application programming interface)
The set of doors one piece of software opens for another: defined requests it accepts and the answers it promises to send back.
Updated October 2026 · with examples from our own builds
What does API mean in practice?
Every app with a backend has an API, even if nobody outside ever sees it: the phone and the website ask the server for data and send it changes. Some products also publish an API so customers can connect their own systems, and then the API becomes a product with its own keys, documentation and support.
Integrations, partner deals and future apps all plug in here. A clean API makes a second app or a customer integration a smaller job. It is also a security boundary, because whatever the API accepts, someone will eventually send.
Every endpoint adds upkeep: tests, error messages people can act on, and a plan for changing it without breaking whoever already depends on it.
API at a glance
- Private or public
- Private APIs serve your own apps; public ones need keys, docs and versioning
- Size signal
- How many endpoints the product exposes
- Must have
- Error responses that say what to fix
Where has API come up in our builds?
Companies create live and sandbox keys in the Pakka for Business portal and book shipments from their own systems. Keys are stored as SHA-256 hashes, so a request is matched by lookup rather than by trying every stored hash.
Every published form is also a plain HTTP POST endpoint for developers, shipped with ready-made HTML, curl and fetch snippets and a list of every response code.
When a customer's bucket is unreachable, the API answers with a 424 carrying a provider-specific code, message and next step rather than a generic 500.
Common questions about API
Should my product have a public API at launch?
Only if early customers need to connect their own systems to get value. A public API brings keys, documentation, a sandbox and a promise not to break it, while a private API for your own apps can change freely.
How should API keys be stored on the server?
As hashes, the way passwords are, so a leaked database doesn't leak working keys. Pakka stores its business API keys as SHA-256 hashes and matches each request by lookup.
Related terms
Sources
Planning a product and not sure where API fits? Ask us, or browse all 116 terms in the glossary.