What an API actually is, and why the word is everywhere
Listen to the audio version
The word API comes up constantly in the technical description of an app, without being explained most of the time. Yet a large part of what an app does day to day rests entirely on this mechanism, one that stays invisible to the person using it.
The restaurant-waiter analogy
An API (application programming interface) works a bit like a waiter in a restaurant. The customer never goes into the kitchen to prepare their own dish: they place an order with the waiter, using a specific menu and phrasing both sides understand, and the waiter comes back with the requested dish, without the customer ever needing to know how it was made. An API plays exactly that role between two pieces of software: an app sends a request in a precise, pre-documented format, and gets a response back, without ever needing direct access to the system that processed that request behind the scenes.
This is the mechanism that lets a weather app show forecasts without owning any satellites, or an online store accept a card payment without managing its own relationships with banks: these apps query another service's API, one specialized in that exact task, instead of rebuilding everything from scratch.
What a request actually contains
A request sent to an API targets a specific address (the endpoint), along with an action (retrieve information, send new data, modify it, delete it) and sometimes extra data the request needs. The response usually comes back in a structured format, most often JSON today: text organized as a series of key-value pairs, easy for any program to parse automatically, regardless of which programming language either side uses.
The API key: the access card that identifies who's asking
Most serious APIs require an API key, a unique string sent with every request to identify who's making it. This key serves several purposes at once: limiting use to those authorized for it, billing a paid service based on actual usage, or simply revoking one specific user's access without affecting everyone else.
An API key deserves exactly the same caution as a password (see the dedicated article): whoever obtains it can act as if they were the legitimate app itself, sometimes with direct financial consequences if the service bills by request volume. An API key accidentally published in a public code repository (a surprisingly common mistake even among experienced developers) can be found and used by anyone within minutes, often well before its owner even notices.
Rate limits: why an API sometimes refuses to answer
Most APIs impose rate limiting, a maximum number of requests allowed over a given period for a given key or address. This limit protects the service against overload, whether deliberate or accidental, and explains why an app can occasionally show a "too many requests, try again later" error even when everything else is working normally.
Why most apps don't reinvent anything
A modern app usually combines several different APIs rather than building everything itself: one for maps, one for payment, one for sending notifications, one for logging in through an existing account instead of managing its own passwords. This dependency has a real downside: when one of these APIs goes down at its provider, every app relying on it can be affected at the same time, even if their own code has absolutely no problem. A single outage, at a sufficiently central API provider, can make dozens of seemingly unrelated services unavailable all at once.
The link to security
The article on the Instagram chatbot breach describes an incident that illustrates this well, even though it doesn't use the word API directly: the flaw came from a missing check in the logic of an automated system processing requests according to precise rules, exactly the kind of mechanism an API implements constantly. A poorly secured API, one that doesn't require a key, or that applies an incorrect check on incoming requests, opens a door that's directly exploitable, without a single person needing to be tricked for it to work.
Understanding what an API is helps map out a large part of what's really happening behind an app, and why so many modern services depend on one another, for better and for worse.