1. Your API is not a Website! 9.15.11 @ 11:05 PST VOIP or Dial-in (see chat) Greg Brail @gbrail Brian Pagano@brianpagano

2. @brianpagano @gbrail

3. API Workshop Webinar Series (videos & slides at http://blog.apigee.com/taglist/webinar) Mapping out your API Strategy Pragmatic REST: API Design Fu 10 Patterns in Successful API Programs What to Measure: API Analytics Is your API Naked? API Tech & Operations Does your API need PCI? (Compliance) Developers Hate Marketing: Driving API Adoption OAuth: The Big Picture “Boss, we need an API” Your API is not a Website!

4. Setup APIs seem at first like web sites without images. On deeper inspection that’s not the case! Examining the differences is a great discussion on API technology.

5. But first, how are APIs and Websites the same?

6. Image by caseymultimedia

7. How are APIs and Websites the same? 24x7 operations

8. How are APIs and Websites the same? 24x7 operations Frequent deployment

9. How are APIs and Websites the same? 24x7 operations Frequent deployment Fast expectations On the Internet this is not news. But inside corporate IT, it is a new way of life! This is the case for public and private APIs.

10. So how are they different?

11. Image by lindzstrom

12. How are APIs and Websites different? Audience Longevity Analytics Security Integration Testability

13. Audience Websites are used by humans APIs are used by programmers. Programmers, in turn, make apps for humans. image by maanow

14. Why does this matter? Developers don’t care about images, fonts, colors, and other design elements. Developers do care about the “look and feel” of the API itself. Is it easy to develop to? Does it use REST appropriately? (according to their own definition of “REST”) Does it make me do anything weird? Does it work? Is it down a lot?

15. Longevity Web sites change all the time. APIs must remain compatible over time. image by wilhelmja

16. Why Does this Matter? Humans are fairly resilient to change We may complain… …but when a site design changes, we (usually) adapt Programs are not resilient to change Developers don’t want to re-write Old apps might not have developers any more Users don’t install updates right away

17. Analytics Most web analytics depend on the browser. API clients might not be browsers at all!

18. Why Does this Matter? API analytics can’t rely on: JavaScript that runs on the client “Beacon” URLs that get downloaded all the time Cookies the client must return API clients just don’t do these things - especially when built by 3rd parties You need to embed analytics on the server. Use what is sent in the request and only that

19. Security Web sites can be scraped carefully. APIs are extremely easy to “scrape” and automate. APIs and web sites need different types of security. OAuth for APIs, passwords for web sites, SSL for both!

20. Why Does this Matter? Since APIs are so easy to program, they are easy to ‘do damage.’ Try to crack passwords using an API Download a company’s whole product catalog Book a whole bunch of flights to mess with pricing Rate limits and quotas are essential.

21. Why Else Does this Matter? Passwords are lousy for public APIs. They propagate to lots of sites that use the APIs They propagate to devices that use the APIs Consider OAuth for these cases

22. Integration Web sites can pull content from all over. APIs sit in one place.

23. Why Does this Matter? The architecture is just different. Websites can include scripts, gadgets, and images from all over the web APIs can’t – developers expect a few API calls to do it all But you can pull things together on the server side…

24. Testability Automated web site testing is hard. Automated API testing is easier.

25. Why Does this Matter? Any API needs to: Change quickly Remain compatible Perform consistently How do you ensure this? Test early and test often Automated regression testing is the key A good API should make this EASY

26. Conclusion A great API is not the same as a great web site. A great API is: Fast-moving, yet it never breaks the apps Reliable, stable, and fast Easy to understand and program to Secure and resilient to failure You need both.

27. THANK YOU Questions and ideas to: @apigee @gbrail @brianpagano