What is an API?

Summary

This video explains how APIs (Application Programming Interfaces) facilitate communication between different systems, such as e-commerce platforms and airline ticket booking systems. It highlights how APIs act as intermediaries, enabling secure data exchange without exposing critical system details like passwords. Through relatable analogies, such as a waiter taking orders at a restaurant, the video illustrates how APIs handle requests and responses, ensuring systems stay protected while sharing only necessary information. The video also touches on API keys, their role in authentication, and practical examples in news and weather apps.

Takeaways

• 🔗 APIs (Application Programming Interfaces) act as intermediaries that enable different systems to communicate with each other securely and efficiently.
• 💻 E-commerce platforms like Amazon use APIs to interact with third-party sellers, allowing secure access to specific functionalities without exposing sensitive data.
• ✈️ For airline booking, APIs allow third-party websites like Paytm or Ixigo to communicate with airlines such as Indigo or Vistara, handling seat availability, booking, and updates in real-time.
• 🔐 An API key is used to authenticate requests, ensuring that only trusted entities can access specific resources. This prevents malicious actors from misusing the system.
• 🚫 APIs can reject requests if the authentication fails or if the requester exceeds allowed limits, acting like a 'security guard' for the actual system.
• 🍽️ The video uses the analogy of a waiter in a restaurant to explain APIs: the waiter (API) takes the order, communicates it to the chef (system), and returns with the response.
• 🔍 APIs typically expose only relevant data and functionality needed by external users, protecting core systems and sensitive information from being accessed directly.
• 📊 API usage is monitored closely to track who is using the data, how much is accessed, and whether the usage adheres to predefined rules and limits.
• 🌐 APIs can sometimes be open and free (no API key required), while in most cases, access is controlled using unique API keys and proper documentation.
• 📚 API documentation is crucial, outlining how to use the API, what data can be accessed, and rules for interacting with the system, making it easier for developers to integrate.

Q & A

What is an API and how does it work?

An API (Application Programming Interface) is a tool that allows different systems to communicate with each other by exposing specific data and functionalities. It acts as an intermediary, allowing one system to send requests and receive responses from another system securely. For example, a third-party website like Amazon can use an airline's API to check seat availability or book tickets without accessing the airline's internal system directly.

Why don't companies like Indigo give direct system access to third-party websites?

Companies like Indigo don’t give direct system access to third-party websites for security reasons. Direct access could lead to security vulnerabilities, data breaches, or system misuse. Instead, they provide an API with specific permissions and an API key to authenticate users, ensuring that only authorized requests are made.

How does an API key help secure interactions between systems?

An API key helps secure interactions by authenticating the user or system making the request. The API checks whether the API key provided matches its records before processing the request. If the key is invalid or missing, the request is denied, preventing unauthorized access to the system.

What happens if an API request is made with an incorrect API key?

If an API request is made with an incorrect API key, the system will reject the request and return an 'invalid credentials' error. Repeated invalid attempts can also result in the requester being blocked from accessing the system.

Can APIs work without an API key?

Yes, some APIs are public and do not require an API key. These are often used when the data being shared is not sensitive and the server can handle multiple requests. However, for most use cases, an API key is required to authenticate and track users.

How do third-party websites like Amazon or Flipkart book airline tickets using APIs?

Third-party websites like Amazon or Flipkart use an airline’s API to book tickets. They send a request to the airline's API endpoint, providing details such as flight information and an API key. The airline’s system checks the request and API key, processes the booking if valid, and sends back the confirmation.

What role does an API play in airline ticket booking systems?

In airline ticket booking systems, APIs allow third-party platforms to communicate with airline servers to access information such as seat availability, booking status, and ticket prices. The API acts as a secure gateway that handles these requests and returns the relevant information or completes a booking.

Why is it important to have different endpoints for different types of API data?

Having different endpoints for different types of API data ensures that systems only expose specific data to the right parties. For example, an airline might have separate endpoints for booking seats, checking seat availability, or flight cancellations. This segmentation improves security and makes API management easier.

What is the advantage of using an API for third-party integration compared to giving direct access?

The main advantage of using an API for third-party integration is security. APIs allow systems to interact without exposing sensitive information or giving full access to the internal system. This reduces the risk of misuse, unauthorized access, and security breaches.

Can an API limit how often a user can make requests?

Yes, APIs can limit how often a user can make requests. This is often referred to as rate limiting. If a user exceeds the allowed number of requests, the API can deny further requests or impose a delay. This prevents overloading the server and ensures fair usage.

Outlines

00:00

🛍️ Understanding E-Commerce and Airline Ticketing Systems

This paragraph introduces the concept of how e-commerce platforms and airline ticket booking systems function. The speaker discusses how sellers on platforms like Amazon can sell products through a dashboard and how third-party websites such as Ixigo, Via, and Paytm can book flights from airlines like Indigo and Vistara. The core issue is the need for different systems to communicate while maintaining trust and security between companies. The concept of APIs (Application Programming Interface) is introduced as the technology that allows this communication while keeping systems secure.

05:02

🔑 The Role of API Keys in Securing System Communication

This section expands on the function of APIs by explaining how API keys are used to ensure secure communication between different systems, such as airlines and third-party booking websites. It highlights how APIs act as gatekeepers, checking credentials (via API keys) before granting access to book tickets or retrieve information. It emphasizes the importance of security in the communication process, ensuring no one can access critical internal systems, like airline servers, without proper authorization.

10:04

🍽️ API Explained Through a Restaurant Analogy

This paragraph uses a simple restaurant analogy to explain the concept of APIs. In the analogy, the waiter represents the API, the customer represents the user making a request, and the kitchen is the server processing the request. Just like a waiter takes the order and communicates with the kitchen, an API facilitates requests to the server, ensuring that requests are authenticated and properly processed. The API may deny requests if conditions, like rate limits, are violated.

📊 API Documentation and Use Cases

The final section discusses how APIs allow controlled access to systems by providing detailed documentation outlining rules, usage limits, and data availability. It uses a news API example, demonstrating how Times of India offers specific data without exposing its entire database. The speaker emphasizes the importance of learning APIs for safe data handling and monitoring, with references to web development and JavaScript courses.

Keywords

💡API (Application Programming Interface)

An API is a set of rules and tools that allows different software systems to communicate with each other. In the video, the API acts as an intermediary between platforms like Amazon and service providers like Indigo Airlines, ensuring that data is exchanged securely without exposing the actual systems or sensitive information. For example, when Amazon books a flight ticket with Indigo, it uses the Indigo API to securely make the booking.

💡API Key

An API key is a unique identifier used to authenticate a user or system making a request to an API. The video explains that companies like Indigo provide an API key to partners like Amazon to identify them when they access the API, ensuring that only authorized entities can make requests. For instance, if Amazon sends a valid API key, Indigo will process the request, such as booking a flight seat.

💡End Point

An API endpoint is a specific URL where a particular service is accessed through the API. In the video, Indigo provides an endpoint like 'goindigo.com/makebooking/' where Amazon can send requests to book flight tickets. The endpoint represents the location on the server where the interaction happens, much like a doorway that controls access to the system.

💡Authentication

Authentication is the process of verifying the identity of a user or system. In the context of the video, authentication occurs when Amazon presents its API key to Indigo's API before making a request, ensuring that the user is who they claim to be. This process prevents unauthorized access to sensitive data, such as flight booking systems.

💡Third-Party Websites

Third-party websites are platforms that offer services provided by other companies, such as booking flights on behalf of airlines. In the video, platforms like Ixigo, Paytm, and Flipkart are third-party websites that interact with airline systems through APIs to provide services such as booking flights for users.

💡Distributed Computing

Distributed computing involves multiple interconnected computers working together to perform tasks. In the video, Indigo's system may use distributed computing in the backend to handle large amounts of data and requests. By spreading tasks across multiple systems, companies can manage workloads efficiently, especially in high-demand situations like booking flights.

💡Request and Response

A request is the action of asking an API for data or a service, and the response is the data or confirmation the API sends back. In the video, Amazon makes a request to Indigo’s API to book a flight, and if the request is valid, the response will be a successful booking confirmation. If the request is invalid, the response could be an error message or denial.

💡Server

A server is a powerful computer or system that provides data and services to other computers, known as clients. In the video, Indigo's server stores the information about flight bookings and seat availability. Amazon communicates with this server through Indigo's API to perform actions like booking a flight without direct access to the underlying system.

💡Data Exposure

Data exposure refers to the act of making certain pieces of data available to other systems while keeping other information protected. In the video, Indigo exposes only the necessary data (such as available seats) to third-party platforms like Amazon through APIs, while keeping sensitive information (such as employee data) private.

💡Documentation

Documentation in the context of APIs refers to a set of guidelines and rules provided to developers to help them use the API correctly. The video mentions that API keys and endpoints often come with documentation explaining how to interact with the API, what data can be accessed, and how often requests can be made. This ensures that developers know how to properly use the API.

Highlights

The e-commerce systems, such as Amazon, allow sellers to interact with buyers via dashboards, providing a structured way to manage sales.

Airline ticket booking involves multiple third-party websites communicating with different airlines to check seat availability and manage bookings.

APIs (Application Programming Interfaces) enable these systems to interact securely, allowing communication without direct access to each other’s internal systems.

APIs help maintain trust between systems by using API keys for authentication, ensuring only authorized parties can access certain data.

For instance, when Amazon wants to book a seat from Indigo, it communicates with Indigo’s API rather than directly accessing Indigo’s system.

API keys function as security credentials, helping the system recognize the request's legitimacy before granting access.

If the API key is valid, the request is processed. If not, the API rejects the request, ensuring system security.

The API acts like a security guard, checking requests before passing them to the server, which stores and processes the data.

Third-party websites like Flipkart or Paytm can book tickets without needing the airline’s internal credentials, thanks to APIs.

APIs are customizable, with endpoints allowing access only to specific types of data, such as available seats or flight cancellations.

The use of APIs prevents security risks, as airlines like Indigo don’t have to share sensitive data such as their login credentials with third-party platforms.

Some APIs are open and don’t require API keys, allowing public access to certain types of data, but most require authentication.

APIs limit how many times they can be accessed in a day, and may block users if they exceed the allowed request limit.

In a restaurant analogy, the API functions like a waiter who takes your order and communicates with the kitchen (the actual system).

APIs enhance system monitoring by tracking how much data is accessed and by whom, ensuring proper data usage.

Transcripts

Guys, whenever I used to think about online e-commerce websites, airline ticket booking and food ordering

How these things work?

then there I used to get very surprised upon hearing

that the e-commerce websites

you guys are a seller and you've been given a dashboard

and you people on an e-commerce store such as amazon

can sell anything there

and a lot of customers... what they can do is buy this stock.

and in this customer need to talk to amazon's store.

dashboard is something we say, is given to affiliated marketers

they need to talk to amazon.in's main system.

How is all this possible?

One very good example we have is of airline ticket booking.

There are a lot of third party websites.

One name that comes to my mind is Ixigo, there's via

and then paytm also book flights.

and with that nowadays amazon, flipkart are also joining this line.

So when this happens, that all these players

can talk to different airlines like Indigo or Vistara or GoAir.

It means that these individual companies could fetch no. of seats that are left, that are booked

or if any ticket is booked, they can update in their systems.

Because if a flight of GoAir is booked

So i need to tell GoAir that I'm Flipkart

I have booked one of your seats, so you don't let the same seat get booked from someone else.

So thats why different systems need to talk to and fro with each other.

What will happen in this, if I'm Amazon

and assume that you are Vistara. Would you say that

"Hey amazon, this is my password, do whatever you want in my server"?

This don't happen. Okay

Because me as vistara or as amazon cannot trust the other company directly.

If here I have Amazon, which I don't, but just assume that I have

then I won't trust Indigo, Indigo won't trust me.

And we'll try to communicate in such a way that the trust remain maintained and the work get done.

So this "trust remain maintained and work get done" is carried out by API

What is API?

Full form of API is Application Programming Interface.

Application Programing Interface.

And this API makes it possible for different systems to interact with each other. Okay

So, this third party website.. rather I'd write websites

those by talking to respective airlines, can do to and fro communication

that hey I booked this seat of yours and you gave me this much commision

I booked this much seats of yours and these type of conversations... Communication keeps on going. Okay

So, what is API if I talk about its definition.

So, API is such a mean that helps these systems in exposing some of their data.

So, I'll write API here that whenever Amazon will talk to Indigo,

it will have to talk to API, it can't talk to the system directly.

So, what will happen here is that Amazon will say to Indigo... It will say

that I want to book one of your seats.

I am Amazon. Okay.

it will do it something like... Amazon to tell Indigo that I have booked a seat of yours.

Suppose Indigo folks have given an end point of their website.

They have said that you indigo.com, maybe its goindigo.com.

goindigo.com/makebooking/ put your API key here.

Everybody has their secret key and

This key is to recognize are you the Amazon?

Its not like I go to Indigo and say book 4 seats and they'll book 4 seats.

It will not happen.

You need to hit this end point with proper API key.

and what API will do is it will, first of all, go to the back hand and

check if Amazon has send this request.

If yes, we will book the seats and send the ticket to Amazon.

but if someone is trying to hack into the system or someone is entering wrong API key

then there we'll... Our response will be... We get a request. API got a request.

Amazon told Indigo, here is my API key and

here is that person's name whose ticket needs to be booked.

Book one ticket from Delhi to Bangalore. Okay

So, Indigo's API will say, stop.

Understand API as something like Indigo is a bungalow, inside the bungalow the owner is sitting.

and API is a security guard.

API will say, STOP! Tell me what is your API key? Show me your API key.

It will match it with its API key. Did we give some API like this to the Amazon?

If yes, okay. Your ticket can be booked.

If not, then it will repulse it away.

It will say invalid credentials. Get Out. Okay

It will say something like this and if it keeps on trying again and again then it'll block it.

There are systems like that too.

So, basically API is an interface that is, it is a way with whose help you can talk to the actual system.

Now, the actual system, that is, Indigo's server

or if they use some distributed computing in the backend.

They cannot give access of all those servers, clusters to Amazon or everyone who are booking through their website.

Its not like Indigo will say "Here's my password, do booking after login." to amazon,flipkart, ixigo, via or paytm.

We are living in a world where people don't reveal there facebook password,

so these business's password is a much bigger deal.

So, what's done here is, everyone is given their own individual API key

and it gets known that who booked how many tickets by sending what requests.

everything will keep getting locked in their system.

So, the advantage of having API is that, the websites like Flipkart, Paytm, via, Ixigo, all these third party websites,

they don't have to give anything to Indigo

there was no need to give them their credentials.

Just imagine, if Indigo here share all of them its password

and someone would destroy their system

Ixigo would say its Flipkart's fault, Flipkart would say it's amazon's fault,

Amazon would say its Via's fault.

So, to avoid all of this, everyone is given their own individual key.

and they'll login from their API key, they will authenticate.

and after authenticating whatever they want to do, get tickets booked

or other services that they provide...

our airlines like how seats are there, how many window seats are left?

Which seats inside the aircraft are paid and which seats are free?

when did which flight got cancelled.

Different end points are made for all this different information.

and all the information that they should get, that is, these third party websites should get

only that is provided to them. They'll not tell them how much money are they making

or Indigo, Vistara, GoAir, they won't tell, what is their employees data

because what will Amazon, Flipkart, Ixigo, Via and Paytm do about their employees data.

They will get the information they want and for this they have to...

and for this information they have to send a request along with the API key.

So, they will send a request with their API key and they will get the proper response.

So, whenever there's a need for Amazon, Flipkart, Paytm to talk to Indigo, API acts as a middleman.

API said talk to me, don't talk to them. The owner is resting. Talk to me.

Tell me what you want. Authenticate everything. If its the right person, their work is done

otherwise show them the door. Okay

So this is how API works.

Now food ordering and online e-commerce websites have this type of APIs.

I would like to mention one thing. Its not necessary for an API to always have an API key.

Its not necessary. Some APIs are free.

Suppose I want to expose some data to the public and I have fast enough servers

then I can distribute the data even without an API key.

I'll say, hit a 'get request' on the website and take data. Okay

So, people expose API in this way too.

But in most of the cases, API data is obtained with the help of API key.

You have to authencicate first after that you get the data.

Now we'll look at a very local example. Okay.

What will be that local example?

Suppose you guys go to a restaurant to eat food and assume I'm the owner there.

Just assume it. What's the harm in assuming?

And here I feed you delicious Palak Paneer.

And you come here and I'm sitting here on the counter. This is me sitting here. Okay.

And suppose this is where the food is cooked. Here our chef's are sitting. Okay.

And this is our waiter. Okay.

So this waiter will ask you what food you want to eat?

This waiter will ask you .

You won't directly come into the kitchen and tell that you want to eat Palak Paneer.

or barge into my office and tell me that you want to eat Palak Paneer.

You won't do it yourself. Assume this as API.

Assume this waiter as API. This waiter is an API.

You approach him first and tell him to bring me one Palak Paneer, one roti, one Paneer Masala.

Whatever you want to eat... Chowmein,omlette.

Whatever you want to eat, you tell him and he notes all that.

He says,'good' X 4. Then he goes into the kitchen.

Sometimes he comes back and say, Sir Palak Paneer is not available, Sorry.

This is how API also returns its request.

You give a request to the API, sometimes API can deny you too.

It can say that you only had to hit me 40 times during a day,

and you are hitting me for the 41st time.

That's why you won't get the data. Sometimes, you get these types of responses from the API too.

So, who is the actual system? Actual system is the chef who is cooking the food.

and who is API? API is this waiter

who is taking in requests from you. Asking what do you want?

It wrote down the order. Now it goes inside and tell who...

she goes and tells the chef and if food is available

our chef sir will tell you that food is available, its cooking.

Sometimes you send a request to the waiter... you ask 'Food isn't prepared yet?'

Waiter tells you that its being cooked, wait a bit.

So, this is also a type of response.

You interact with an API and give it a request and its gives you back the response.

If I summarize all this, then I'll say

API is used so that the access to the actual system is not given to someone else.

We made an API and whoever wants some data of our system,

we'll expose those API to them, give them end points with proper API key

And with the help of this API key, we'll monitor who accessed how much data from our server.

API keys in most of the cases are documentations.

API keys are docs in which all information is written on how to use and rules.

How many times you can hit the API,

how many times you can send more request after extracting data.

What data can you extract from the API?

All this is written in documentation in most of the cases.

If I take one example of an API, it is news API that I taught you in Java Script course probably.

In that we made an app that extract all the news from a website with the help of a news API.

There was an API key too.

Now the Times of India folks... they don't want to give you the access to the whole server's database.

They cannot afford this. If you do something wrong there, they might get in a lot of trouble.

That's why they give you an API, oh okay, you want this, you take its API.

and after that if you want more data, send them another request.

So in this way for monitoring...

With this, APIs are used to safely handle the data.

It also lets you know who is using how much of data?

and with this your monitoring,that is,how much your actual system is being used and by whom.

All this is also done very well. I hope you guys understood API.

If you have understood, start using APIs.

I have taught you to use a lot of APIs

for example our news API. There's weather API.

So learn to access these types of APIs.

I have put on my web development, java script course. I would tell you that after this video

you go... if you are a web developer, you can checkout my web development course. Checkout my Javascript course.

We have seen a lot of APIs there. I hope you all liked this video.

Thank you so much for watching this video and I will see you next time.