What Is an API? A Plain-English Explanation for AI Builders

What an API actually is, without the jargon

Strip away the acronym and an API is a contract: a fixed set of rules two pieces of software agree to follow so they can talk to each other reliably. One side sends a request in a specific, expected shape, the other side sends back a response in a specific, expected shape, and neither side needs to know anything about how the other one actually works internally. PayFast doesn't need to know your app is built in Lovable. Your app doesn't need to know how PayFast processes a card. Both sides just need to follow the agreed rules for asking and answering.

That's the whole idea. Every other detail, REST versus other technical styles, specific request formats, is implementation detail that matters to whoever is writing the request. On an AI-built site, that's your AI agent, not you.

You don't write the API call, your AI agent does

This is the part that changes for a vibe coder specifically. A traditional developer learning to use an API spends real time reading its documentation and writing the request by hand. When you ask Lovable, Base44, Bolt.new or Claude Artifacts to "connect PayFast" or "send a WhatsApp message when someone submits the form," the agent reads the platform's documentation itself and writes the actual request code, the same kind of code a developer would write by hand. Your job shifts from writing the call to describing what you want clearly enough that the agent builds the right one, and to recognising the vocabulary well enough to understand what's happening when something goes wrong.

Where you'll actually run into this term on your own build

A handful of words show up constantly once an AI-built project starts talking to the outside world, and they're worth recognising rather than treating as unfamiliar jargon each time. An endpoint is the specific address a request gets sent to, PayFast's checkout endpoint is a different address from its webhook endpoint, even though both belong to the same API. A request is what your app sends; a response is what comes back. An API key (sometimes called a secret, a token or an access token depending on the platform) identifies your account to the service you're calling. A rate limit caps how many requests you're allowed to send in a given period, which is why a sudden flood of activity can start failing even though nothing about your code changed.

Every payment gateway, email service or messaging service you connect is an example of exactly this: a specific API, with its own address, its own request shape and its own key, wrapped in the same underlying pattern.

The one safety rule that actually matters: API keys are secrets

An API key proves you're allowed to make a request, sometimes on your account, sometimes with money attached. Anyone who gets hold of a live key can act as if they were you: sending messages on your account, or in a payment integration's case, potentially forging a request that looks legitimate. This is exactly why a key belongs as a secret in a backend function rather than in code the browser can read, and why a key pasted directly into frontend code is visible to anyone who opens their browser's developer tools, no special skill required. Keeping a key server-side isn't extra caution for a nervous developer; it's the one non-negotiable rule that makes the rest of an API integration actually safe to ship.

Not every API behaves the same way

Two APIs that look similar on the surface can differ in ways that matter once real usage starts. Some are free to call, some charge for each request, and some, like payment providers, charge for each transaction instead of each call. Some need nothing more than an account; others ask you to go through a verification process before you can use them for real. A provider can also change its API over time, adding a required field or retiring an old version, sometimes with little warning. So before you trust any guide's details about a specific API, check them against the provider's own current documentation, or ask your AI to.

What is an AI API?

An AI API is an ordinary API whose answers are written by an AI model. Your app sends it a request, such as a question, and it sends back what an AI model wrote. It works like any other API, with a key, a request and a response. What's different is that the answer can change each time.

That last part matters when you build with one. Ask the same question twice and you can get two different answers, so your app has to cope with replies it didn't expect, and anything important in them is worth a check before it's shown to a visitor. The key follows the same rule as every other secret: it lives in your backend, never in the page (why an API key can't go in the frontend). The AI chat assistant you use and an AI API can run on the same model; the API is simply how an app reaches that model without a chat window.