API: The damn thing opens a whole lotta doors!
By: Timothy Bamiro
Tags: Data, Software Development, API, Nginx, DevOps

An API is a set of definitions-codes, protocols for building and integrating application software.

If you are new to Tech lingo, let me chip this in; I bet you’ve been searching for answers to these questions.

Are the stuff we interact with on the internet called Apps? Isn’t it just the stuff I got on my phone that are called Apps?

Err, yeah, they are apps…………………mobile apps.

Pains me to puncture your bubble but I’ll make it painless for you; everything you interact with on the web is an application. This explains it better- web apps are websites with functionality and interactive elements.

Boom! Everything you interact with on the web is AN APP!

Now that we’ve got that out of the way, and we know that our functioning and interactive websites-like Instagram and Gmail are web apps, let’s step into APIs for real.

I like how imotions makes it so vivid: “APIs unlock a door to software (or web-based data), in a way that is controlled and safe for the program”. The API is made up of codes==requests to the receiving software. Then data is returned to the requesting software or App.

When it comes to API Gateway and API Management, Nginx is my go-to.

API Management

Get this first- it’s a process. A process of designing, publishing, distributing, documenting and analyzing APIs in a secure environment. It refers to the overall solution of managing APIs in the production environment and it includes a set of APIs acting in clusters and an administrative UI.

Here you have an API dashboard, some form of queuing. You log onto it and manage your policies. It can be split into different operations:

Policy Management:

Policies get executed sequentially upon a request of an API. Policies determine the behaviour of the API. You just have to create these policies through configuration.

Policy Examples

Limit call rate by subscription Set usage quota by subscription Validate JWT (JSON Web Token) Control Flow Forward Request

Analytics and Monitoring

You can view the metrics coming out of the gateway. All the operations here help developers gain visibility into performance, availability and functional correctness. Your DevOps team can track performance and uptime here. On the business side of things, the Product Designers and marketing team can track customer retention, engagements and conversion.

Developer Documentation

Developers can see which APIs have been published. As a DevOps team, this shouldn’t be underestimated. Documentation is so vital in API management. It contains all the necessary instructions for DevOps engineers to effectively use and integrate APIs.

API Gateway

An API Gateway is an API management tool that sits between a client and a collection of backend services. An API Gateway acts as a reverse proxy. It accepts all incoming application programs in the first call (API call) and aggregates the various services at the backend which are required to fulfill the specific request and returns the expected result to the requester.

A specific API gateway accesses a data plan. API management tool accesses the control plan.

Let’s simulate an API request, shall we?

API Request

Standard/Conventional API Call: GET/pricing/air001

(someone trying to buy an airpod on AliExpress, this guy can’t get a discount or something of the sort; he is going to just click and buy)

Exotic API Call: PATCH/pricing/air001 {“price” 16.60, “currency”: “USD” “max_discount”: “30%”}

(This guy can change the price of his airpod; he has got a discount API and he’s going to get the airpod way cheaper)

Let me tell you a secret, promise you won’t scream, yes, cross your heart!

“coupons/coupon codes are technically APIs”

Now imagine the power you wield being able to create coupon APIs.

In this illustration, what we care about is:

Whether the requester is permitted to change the price of the product. Are we allowed to accept the JSON payload (yes…the payload type is JSON)? Can the requester go out and change the currency?

Nginx running as an API Gateway

Nginx can run virtually everywhere; can run on a local, run on the cloud, run on Docker files or even raspberry pi.

PS: API Gateway is a subset of API management.

API Gateway Functions (The Nginx perspective)

TLS termination Client Authentication Load Balancing And More.

TLS termination

Nginx enables you to terminate your TLS at the gateway. SSL Certificate can be stored on the disk in the keyval in Nginx Plus.

Request Routing

Request routing uses location (URI) matching.

Exact

location = /api/c2/seasons { proxy_pass http://c2-api; }

It’s an exact match if the request needs that specific routing. It will go out and be routed to that specific endpoint.

Regex

Location ~ /api/c2/ [12] [0–9]+ { proxy_pass http://c2-api; }

It’s designed to take a specific year and input parameters after it. You can get really creative with Nginx and Regex.

Load Balancing

The sticky session is a smart method used in load balancing. Each request is routed to the server which initially served the request. Nginx creates a cookie and it is sent as a response and always realizes which server served the initial request this way.

All NGINX Load Balancing methods are applicable.

upstream c2-api ( server 10.1.1.4:8001 server 10.1.1.4:8002 sticky cookie srv_id expires = 1h; )

Rate Limiting

limit_req_zone is used to globalize rate limiting. However, each location can be rate-limited independently. If an Nginx instance gets more than the Nginx established rate limit, the requester gets a 429 error.

Client Authentication

auth_jwt directive is used here. Authentication is possible based on a key or JWT in the program. Nginx will introspect the token data and match it to the uid parameter. Then if the value is a match, the request is proxied to the c2 API. If not, whew, you get…

“return 403 “Forbidden: Not Authorized to Access”;

Uh-oh, I’m not campaigning for Nginx, but you can only use this on Nginx Plus.

Anyways, I look forward to hearing your viewpoints and contributions on software accessibility, authentication and more of the DevOps culture. I gotta say, my content isn’t limited to the traditional software space but I also break down the myths and legends of Business and Strategy and their integration with software.

And my content is always relatable by both professionals and newbies in software and software-related fields. So if you have any questions, shoot away or you can also reach me on Twitter.

Thanks for Reading💙.

Please leave a comment if you have any thoughts about the topic — I am open to learning and knowledge explorations.

I can imagine how helpful this post has been, do leave a clap 👏 below a few times to show your support for the author!