API: how your service talks to other systems

REST is the most widespread, most mature, most documented type. Standard pick for public APIs. Documented via OpenAPI 3 spec; SDK generation is automatic.

GraphQL: client picks exactly which fields it wants; solves over-fetching and under-fetching. Right for shared data needs across mobile + web.

tRPC: fastest path for full-stack TypeScript projects. End-to-end type safety; no SDK generation needed since TypeScript itself is the SDK.

Resource-based URLs (REST) or schema-first design (GraphQL), consistent naming convention, pagination, filtering, sorting standardization, error format consistency (RFC 7807 problem details), versioning strategy (URL path or header).

These aren't 'details'; they shape the 5–10-year usability of your API. Badly designed APIs need breaking changes later, which annoys your users.

API auth options: OAuth 2.0 (third-party access), API key (server-to-server), JWT (user-scoped short-lived), session-based (browser). We pick by use case.

Rate limiting (per-user, per-IP, per-endpoint), correct CORS, input validation (Zod), SQL injection prevention, secrets rotation — security basics.

API success depends on developer experience. Auto-generated docs via OpenAPI 3 (REST) or GraphQL schema. Interactive docs via Swagger UI / GraphQL Playground / tRPC docs.

SDK generation (TypeScript, Python, Go) is automatic. Postman collection, code samples, getting-started guide — part of the standard package.