API traffic and authentication basics
Published Updated
This is the Learning Atlas from Orbit. Get your invite
Misc tech termsConcepts and methodology
-
Step 1: API
Why this matters here
API starts the path because the learner first needs to identify the boundary where one program asks another for data or action.
In short
A set of rules and protocols that allows two completely separate software systems to communicate and share data with each other seamlessly.
-
Step 2: REST
Why this matters here
REST gives that boundary a common design style, making endpoints, resources, and verbs easier to reason about.
In short
A standard architectural style for designing APIs, using predictable URLs and standard HTTP methods (GET, POST, PUT, DELETE) to manage data.
-
Step 3: HTTP/HTTPS
Why this matters here
HTTP/HTTPS belongs next because REST traffic needs a transport layer with methods, headers, status codes, and security expectations.
In short
The foundational communication protocol used to transmit data securely across the internet between a web browser and a server.
-
Step 4: CORS
Why this matters here
CORS matters once browser-based requests enter the picture, because it explains why a correct API can still be blocked by policy.
In short
A strict web security mechanism enforced by browsers that dictates whether a frontend application hosted on one domain is legally allowed to request data from an API hosted on a different domain.
-
Step 5: OAuth
Why this matters here
OAuth is introduced after traffic mechanics because many APIs need delegated access rather than simple anonymous calls.
In short
An industry-standard protocol that allows a user to securely grant a third-party application limited access to their data without ever sharing their actual password.
-
Step 6: JWT
Why this matters here
JWT follows OAuth because tokens are a common way delegated identity and authorization claims move through API systems.
In short
A compact, cryptographically signed token used to securely transmit information (like user identity and permissions) between a client and a server.
-
Step 7: Session
Why this matters here
Session closes the path by contrasting token-based calls with server-tracked login state that shapes real user authentication flows.
In short
A temporary, secure storage mechanism that keeps a user logged in and tracks their continuous interactions with a website over a specific period of time.