API

If you've ever ordered at a ticket window, you already understand APIs.

Your frontend has no hands. An agent doesn't either. Neither one can log into Postgres, click around a dashboard, or rummage through someone else's files. They don't need to. Stripe has an API. Slack has an API. The backend you just scaffolded has one. That window is how anything gets done outside the chat box.

So picture the booth.

You walk up. A menu is taped to the glass:

• create a todo
• fetch this user
• send this email
• charge this card

You pick a line, you pay, food comes out. You never go in the kitchen. You never touch the database. You order what's printed, and the kitchen does the work.

That's an API. Application Programming Interface — a window between two programs, with a menu the kitchen wrote.

The first time people open the builder they treat "API layer" like a flavor of ice cream. It isn't. It's whether your dining room and your booth share a menu. Pick tRPC or oRPC and the TypeScript on both sides is the same order form. Pick REST and you write the addresses by hand, the way every stranger on the internet already knows. Pick none and you have a pretty room with no window — fine for a screenshot, fatal on the second click.

The menu is the fence.

A caller can only order what's listed. If "drop every table" isn't on the board, they cannot have it. The window does not take off-menu requests. So an API is a lock as much as a door. The app decides the specials. Everything else stays in the walk-in.

That's why a company will open a window at all. They're not handing you the knives. They're handing you a menu they typeset, with a wall around the rest.

Same story when you give an agent MCP or a tool list. The tools are the menu. If delete_repo isn't on it, the model can talk about deleting. It cannot order it.

Every window checks for a key.

To stand at the glass you prove you're on the tab. That proof is an API key, a session cookie, or a token from auth — a long random string that means "charge this to my account, let it through."

One rule, said plainly:

Never paste an API key into code you will push.

Code lands on GitHub. A lot of GitHub is public. A key in the repo is a credit card taped to the glass. Bots read GitHub for exactly this. They find the string, and they start ordering on your dime. Keys live in an env file instead — a sticky note that does not get committed.

What this unlocks

Once you see the window, "how does the AI actually do anything" stops being a mystery. It is not being clever with words. It is placing orders:

• Scaffold a project from a CLI command
• Pull rows out of your database and summarize them
• Post in Slack when the build goes red
• Create a checkout, send a mail, flip a feature flag

Without an API, your UI is a poster and your AI is a talker. The poster can fake a list. The talker can draft an email and sit there, unable to send it. With a window, the same UI says GET /todos, the same agent says "send this," and the kitchen moves.

That's the leap. A poster is a demo. A window is a product. A talker is a chatbot. A menu is an employee.