What is API?

The part of an app that other programs talk to. Your app's pages ask its API for data, like a waiter taking orders to a kitchen.

Where API goes wrong in real apps

Each of these is a short scenario built from a real failure in an app made with AI. Read the answer here, or walk through it yourself in about four minutes.

Bills that explode · 5 minutes · Pro
The address box that cost $1,900
Your checkout suggests addresses as people type, using a maps API. Orders are steady, but this month's maps bill is $1,900.
How do I reduce my Google Maps API bill?
Count what triggers each call. Address autocomplete often sends a billable request on every keystroke. Wait for a short pause and a few characters, use session tokens so searches can be billed together when a place is chosen, restrict your key to your site and the APIs you use, set daily quotas, and cache only what the provider's terms allow.
Read the fix
Money and secrets · 4 minutes · Free
The key in the bundle
Your OpenAI bill jumped from $40 to $3,900 overnight. Your app has 60 users.
Is my API key exposed in my frontend code?
If the key is in a variable with a public prefix such as NEXT_PUBLIC_, VITE_ or EXPO_PUBLIC_, or used in client code, it is in your JavaScript bundle and anyone can copy it. Revoke the key, create a new one, and call the paid API from your server only.
Walk it, free
Who may see what · 4 minutes · Pro
Open it in incognito
Everything works when you are signed in. A security researcher emails: 'Try your API from a private window.'
How do I test my app for exposed data?
Test every page and API route as four people: signed out, a normal user, a different user, and an admin. Any endpoint that returns data or makes changes for someone who should be refused is a security bug. Testing only while signed in as yourself hides these bugs.
Read the fix
Accounts and privacy · 4 minutes · Pro
Customer data in the prompt
Your new AI support summary sends every support conversation, with names, emails and order details, to an AI provider. A customer asks where their data goes.
Can I send customer data to an AI API?
You can, but it means sharing personal data with another company, so your privacy policy and agreements must cover it. Send only what the feature needs, removing names, emails and payment details first. Use a plan or setting that doesn't train on or retain your data longer than needed, accept the provider's data processing agreement, and list the provider.
Read the fix
Into the app stores · 4 minutes · Free
The key inside the app
Your phone app went live on Friday. By Monday your OpenAI bill is $2,300, and the usage page shows requests your app never makes.
Can people see API keys in my Expo app?
Yes. Expo copies every EXPO_PUBLIC_ variable into the JavaScript inside your app, and anyone can download the app and read it. Public keys like the Supabase anon key are fine there. Secret keys for OpenAI, Stripe or other paid services must stay on a server function that your app calls instead.
Walk it, free
Launch day · 4 minutes · Pro
The upload that was too big
Users can upload photos to their listings. Phone photos fail with '413 Payload Too Large'. Screenshots work fine.
How do I fix 413 Payload Too Large on uploads?
Serverless functions limit how large a request body can be, so large files fail when sent through your API. Have your server create a signed upload URL after checking the user, then let the browser upload directly to storage. Enforce file type and size limits on the storage bucket itself.
Read the fix

Request: A message your browser (or any program) sends to a server asking for something: 'give me invoice 105' or 'save this profile'.
Server: A computer that runs your app's code out of sight. Users can't change what happens there, which is why checks belong there.
Secret key: A password your app uses to talk to a paid service. Anyone who sees it can use it, and spend your money.
Browser: Chrome, Safari and friends. Everything that runs here is visible to, and changeable by, the person using it.
Authentication: Checking who someone is, usually by signing in.
Database: Where your app keeps its data, organised in tables, like a set of spreadsheets.

All 62 terms in the glossary

Where API goes wrong in real apps

Each of these is a short scenario built from a real failure in an app made with AI. Read the answer here, or walk through it yourself in about four minutes.

Bills that explode · 5 minutes · Pro

The address box that cost $1,900

Your checkout suggests addresses as people type, using a maps API. Orders are steady, but this month's maps bill is $1,900.

How do I reduce my Google Maps API bill?

Count what triggers each call. Address autocomplete often sends a billable request on every keystroke. Wait for a short pause and a few characters, use session tokens so searches can be billed together when a place is chosen, restrict your key to your site and the APIs you use, set daily quotas, and cache only what the provider's terms allow.

Read the fix

Money and secrets · 4 minutes · Free

The key in the bundle

Your OpenAI bill jumped from $40 to $3,900 overnight. Your app has 60 users.

Is my API key exposed in my frontend code?

If the key is in a variable with a public prefix such as NEXT_PUBLIC_, VITE_ or EXPO_PUBLIC_, or used in client code, it is in your JavaScript bundle and anyone can copy it. Revoke the key, create a new one, and call the paid API from your server only.

Walk it, free

Who may see what · 4 minutes · Pro

Open it in incognito

Everything works when you are signed in. A security researcher emails: 'Try your API from a private window.'

How do I test my app for exposed data?

Test every page and API route as four people: signed out, a normal user, a different user, and an admin. Any endpoint that returns data or makes changes for someone who should be refused is a security bug. Testing only while signed in as yourself hides these bugs.

Read the fix

Accounts and privacy · 4 minutes · Pro

Customer data in the prompt

Your new AI support summary sends every support conversation, with names, emails and order details, to an AI provider. A customer asks where their data goes.

Can I send customer data to an AI API?

You can, but it means sharing personal data with another company, so your privacy policy and agreements must cover it. Send only what the feature needs, removing names, emails and payment details first. Use a plan or setting that doesn't train on or retain your data longer than needed, accept the provider's data processing agreement, and list the provider.

Read the fix

Into the app stores · 4 minutes · Free

The key inside the app

Your phone app went live on Friday. By Monday your OpenAI bill is $2,300, and the usage page shows requests your app never makes.

Can people see API keys in my Expo app?

Yes. Expo copies every EXPO_PUBLIC_ variable into the JavaScript inside your app, and anyone can download the app and read it. Public keys like the Supabase anon key are fine there. Secret keys for OpenAI, Stripe or other paid services must stay on a server function that your app calls instead.

Walk it, free

Launch day · 4 minutes · Pro

The upload that was too big

Users can upload photos to their listings. Phone photos fail with '413 Payload Too Large'. Screenshots work fine.

How do I fix 413 Payload Too Large on uploads?

Serverless functions limit how large a request body can be, so large files fail when sent through your API. Have your server create a signed upload URL after checking the user, then let the browser upload directly to storage. Enforce file type and size limits on the storage bucket itself.

Read the fix

Related terms

Request

A message your browser (or any program) sends to a server asking for something: 'give me invoice 105' or 'save this profile'.

Server

A computer that runs your app's code out of sight. Users can't change what happens there, which is why checks belong there.

Secret key

A password your app uses to talk to a paid service. Anyone who sees it can use it, and spend your money.

Browser

Chrome, Safari and friends. Everything that runs here is visible to, and changeable by, the person using it.

Authentication

Checking who someone is, usually by signing in.

Database

Where your app keeps its data, organised in tables, like a set of spreadsheets.