APIs

What belongs in an API request?

Inspect the method, destination, headers and body separately. GET usually retrieves data; POST commonly submits an action. The provider defines the actual contract. A correct URL with the wrong authorization header can still fail, and a JSON response is not necessarily a successful response.

HTTP 401
{"error":"missing_credentials"}

This example points to missing identity. Check whether the credential was attached where the provider expects it. Do not paste a secret into browser code to make the request work: a server-held credential needs a server-side handler that validates the caller and restricts the permitted action.

What should happen when the provider rejects the call?

1. 1Check the HTTP status before interpreting the body as success.
2. 2Show a useful failure state without exposing credentials or private response data.
3. 3For a 429, follow the provider's retry guidance and avoid duplicate submissions while a request is pending.
4. 4For a state-changing action, check the provider's idempotency support before retrying; a timeout does not prove nothing happened.

Read API keys explained for public-versus-secret handling, the API workflow guide for browser-to-server traffic, and the status-code guide when a specific request is failing. Share a redacted error and the request shape, not a working credential.