What is an application programming interface (API)?
An application programming interface (API) is a contract that lets one piece of software use another. It defines what requests a service accepts, what data it expects, and what it returns, so that apps can rely on each other's capabilities without knowing each other's internals.
Most modern products are assembled this way. A weather app doesn't run its own satellites; it calls a weather service's API. A checkout page doesn't process cards; it calls Stripe's API. A vibe-coded app that summarizes documents doesn't contain an AI model; it calls one through an API.
How does an API work?
An app sends a request to an endpoint, a specific URL that represents one capability of the service. The request carries a method (fetch, create, update, or delete), any needed data, and usually an API key that identifies who's calling. The service responds with structured data, most often JSON, that the app then uses.
Most web services follow this request-and-response pattern, commonly in a style called REST. The mechanics matter less to a vibe coder than the moving parts: an endpoint to call, a key to include, and a response to handle, including the case where the response is an error.
Why do APIs matter in vibe coding?
APIs are where a vibe-coded app gets its powers. AI features come from model providers' APIs, payments from Stripe, email from Resend or similar services, maps, weather, and databases from theirs. The AI writes the connecting code in seconds, which makes integrations feel free.
The responsibilities that come with them aren't automated away, though. The builder still creates accounts, obtains API keys, keeps those keys out of the code, and watches what the connected services charge. The AI wires the plumbing; the builder owns the accounts it connects.
What kinds of APIs does a typical vibe-coded app use?
A handful of categories cover most projects. AI model APIs (Anthropic, OpenAI) add generation, summarization, and chat features. Payment APIs like Stripe handle checkout and subscriptions without the app touching card data. Communication APIs send email through services like Resend or SendGrid, and texts through Twilio.
Data and infrastructure round it out: database services like Supabase or Firebase expose storage through APIs, and providers like Google Maps supply geodata. Each integration follows the same pattern (account, key, endpoint, response), which is why experience with one API transfers so readily to the next.
What are the costs and risks of using APIs?
Many APIs bill per request or, for AI services, per token, usually with a free tier that covers experimentation. Costs become real when an app reaches users or when a bug puts a call inside a loop, which is why spending limits on every paid service are standard practice.
The other standard risk is key exposure. An API key embedded in code that reaches a browser, a public repository, or a shared chat can be extracted and used by anyone, with the charges landing on the key's owner. Keys belong in environment variables, and any exposed key gets revoked and replaced rather than quietly deleted from the code.
