3 ms·

I find this confusing because the point of an API is to be known, yes? Otherwise who's accessing it?

• quesera 2y ago
  It's a valid desire, but you have to be really dedicated to the effort to block it, in practice. You might intend your API to be consumed only by your own clients. E.g. your published mobile apps. A well-designed API won't allow a third-party client to do anything that your own client wouldn't allow of course. Permissions are always enforced on the back end. But there are many cases where a user might want a custom/different client: If your mobile apps are not awesome, or if they deprioritize a specific use case, or if they serve ads ... or even if your users want to automate some action in your service... If your service is popular enough (or you attract a certain kind of user), you will have some people building their own clients.
  • bandrami 2y ago
    Those sound like bad use cases for a client-server model with public endpoints, then? I mean, you could cert-pin yourself in the client app, I guess.
    • quesera 2y ago
      Not sure what you mean here. All endpoints are equally public.
• kube-system 2y ago
  Not necessarily. A common pattern is to build a 'private API' intended to be used by one's own front-end applications. For example: most client-rendered applications, like the Airbnb example on this page.
• nsonha 2y ago
  Modern APIs are actually most of the times poor man's RPC, they don't need to exist, much less known.