4 ms·

This is a quite arrogant post. I do not make APIs but I can understand some needs of the API providers. First of all you are being arrogant because you if you j

This is a quite arrogant post. I do not make APIs but I can understand some needs of the API providers. First of all you are being arrogant because you if you just want an URL and nothing more means that for you every API must be free and this is totally bullshit. Also giving you a URL and nothing more gives me no control on what you do. You could harm my service by doing too many request or god knows what and I could do (almost)nothing without hurting maybe other developers. Conclusion: think of the others before ranting. P.S. the code samples are there help all the people that are not great developers as you.

ivanb 14y ago
Nowhere in the post he writes that the APIs must be free. Maybe he just wants to pay with money instead of time and attention.
- mithras 14y ago
  That would imply the need for an API key though, and he mentions that he doesn't want those.
  - georgebashi 14y ago
    API keys are not the only method of authentication.
    - Bootvis 14y ago
      What other methods are available that don't require registration?
eps 14y ago
Counterpoint - http://api.dribbble.com http://api.dribbble.com
- batgaijin 14y ago
  Which is a fantastic API, I must say.
- jyap 14y ago
  To be fair, that page does mention: Currently, no API key is required, but this will likely change so we can better monitor usage and enforce the Terms of Use (below).
tommorris 14y ago
There's a few things I'll push back on: I could harm your service by making too many API-key signed, OAuth-signed requests too. I could harm your service by hitting your website a lot too. We have ways of dealing with people who intentionally or unintentionally launch the equivalent of denial of service attacks: you block their IPs and move on. There's no need to have a special magical way of doing it with an API. The point is the whole concept of an API should be unnecessary. We have a way of saying where data is: URLs. We have a way of specifying what format the client wants it in: content negotiation (Accept headers). We have a way of retrieving that data: HTTP GET. There's a reason why BugMeNot exists for websites. API keys are basically pointless registration pages for access to the same data that is being published on the web. As for the code samples: if there's little more needed than "here's the URL of our data", I don't need a code sample. I only need a code sample when it's been made ridiculously over-complicated. (My favourite API recently: clockworksms.com - all of the other SMS providers I've looked at want me to talk to some salesman and/or read complicated docs. Clockwork just let me send an HTTPS POST message. They have an API key, sure, but they required only an email address to get it. And I can pay for credits with PayPal. Ridiculously simple. I like.) As for arrogancy? Guilty as charged. I'll say in my defence that it's more that the data I wanted to retrieve from the service in question (which I won't name) was exceptionally simple, had no commercial value in itself, but would send referrals to the site that they could monetise (and there's no affiliate scheme, I wasn't gonna profit off this). There literally is no business reason to lock that kind of API down. It's just cargo-cult API design: everyone else has API keys, they must have a reason, so I better have that too.
- overbroad 14y ago
  "cargo-cult". That's the term I was looking for. Monkey see, monkey do. Code monkey mimicry. If thinking for yourself is "arrogance", then we need more "arrogant" people involved in web design. It's not the "API" that is the method of providing and restricting access. It's the IP address. Any reasonably smart user can figure out the "API". They do not need a lengthy manual. A few examples, mere hints, is all that is needed.
- opminion 14y ago
  Rants are always best with actual examples of what's being ranted. Just as http://tommorris.org/posts/2451 http://tommorris.org/posts/2451
cousin_it 14y ago
Paid APIs should have the minimum amount of bullshit to determine who pays what. Free APIs should have no bullshit. Request throttling doesn't require API keys.
- alexchamberlain 14y ago
  It depends what you are throttling by.

ivanb 14y ago

Nowhere in the post he writes that the APIs must be free. Maybe he just wants to pay with money instead of time and attention.

mithras 14y ago
That would imply the need for an API key though, and he mentions that he doesn't want those.
- georgebashi 14y ago
  API keys are not the only method of authentication.
  - Bootvis 14y ago
    What other methods are available that don't require registration?

eps 14y ago

Counterpoint - http://api.dribbble.com http://api.dribbble.com

batgaijin 14y ago
Which is a fantastic API, I must say.
jyap 14y ago
To be fair, that page does mention: Currently, no API key is required, but this will likely change so we can better monitor usage and enforce the Terms of Use (below).

tommorris 14y ago

There's a few things I'll push back on: I could harm your service by making too many API-key signed, OAuth-signed requests too. I could harm your service by hitting your website a lot too. We have ways of dealing with people who intentionally or unintentionally launch the equivalent of denial of service attacks: you block their IPs and move on. There's no need to have a special magical way of doing it with an API. The point is the whole concept of an API should be unnecessary. We have a way of saying where data is: URLs. We have a way of specifying what format the client wants it in: content negotiation (Accept headers). We have a way of retrieving that data: HTTP GET. There's a reason why BugMeNot exists for websites. API keys are basically pointless registration pages for access to the same data that is being published on the web. As for the code samples: if there's little more needed than "here's the URL of our data", I don't need a code sample. I only need a code sample when it's been made ridiculously over-complicated. (My favourite API recently: clockworksms.com - all of the other SMS providers I've looked at want me to talk to some salesman and/or read complicated docs. Clockwork just let me send an HTTPS POST message. They have an API key, sure, but they required only an email address to get it. And I can pay for credits with PayPal. Ridiculously simple. I like.) As for arrogancy? Guilty as charged. I'll say in my defence that it's more that the data I wanted to retrieve from the service in question (which I won't name) was exceptionally simple, had no commercial value in itself, but would send referrals to the site that they could monetise (and there's no affiliate scheme, I wasn't gonna profit off this). There literally is no business reason to lock that kind of API down. It's just cargo-cult API design: everyone else has API keys, they must have a reason, so I better have that too.

overbroad 14y ago
"cargo-cult". That's the term I was looking for. Monkey see, monkey do. Code monkey mimicry. If thinking for yourself is "arrogance", then we need more "arrogant" people involved in web design. It's not the "API" that is the method of providing and restricting access. It's the IP address. Any reasonably smart user can figure out the "API". They do not need a lengthy manual. A few examples, mere hints, is all that is needed.
opminion 14y ago
Rants are always best with actual examples of what's being ranted. Just as http://tommorris.org/posts/2451 http://tommorris.org/posts/2451

cousin_it 14y ago

Paid APIs should have the minimum amount of bullshit to determine who pays what. Free APIs should have no bullshit. Request throttling doesn't require API keys.

alexchamberlain 14y ago
It depends what you are throttling by.