API Patterns

REST, GraphQL, gRPC comparison and best practices

Not Started
Loading...

Choosing the right API pattern impacts performance, developer experience, and system evolution. REST provides simplicity and caching, GraphQL offers flexibility and efficiency, while gRPC delivers speed and type safety. Each has its sweet spot in modern architectures.

The practical approach: use REST for public APIs, GraphQL for complex UIs, gRPC for microservices. REST's HTTP semantics work everywhere, GraphQL solves over/under-fetching, and gRPC's binary protocol and streaming excel in service-to-service communication.

API Architecture Patterns

Different API patterns serve different needs. Choose based on your use case, team expertise, and performance requirements.

Learning Curve
2/10REST
8/10gRPC
Performance
6/10REST
9/10gRPC
Ecosystem
10/10REST
7/10GraphQL
Flexibility
6/10REST
9/10GraphQL

REST

Resource-oriented HTTP APIs

Latency: 100-200ms
Payload: 2-10KB
Strengths
  • Simple & widely understood
  • Stateless
  • Great tooling
  • Cacheable
Weaknesses
  • Over-fetching
  • Multiple round trips
  • Versioning challenges
Best For

CRUD operations, public APIs, simple data models

GraphQL

Query language with single endpoint

Latency: 50-150ms
Payload: 1-5KB
Strengths
  • Precise data fetching
  • Strong typing
  • Single request
  • Real-time subscriptions
Weaknesses
  • Complexity
  • Caching challenges
  • Query depth attacks
Best For

Complex data relationships, mobile apps, rapid frontend development

gRPC

High-performance RPC framework

Latency: 1-10ms
Payload: 0.5-2KB
Strengths
  • High performance
  • Strong contracts
  • Bi-directional streaming
  • Multi-language
Weaknesses
  • Browser limitations
  • Less human-readable
  • Learning curve
Best For

Microservices, real-time systems, internal APIs

API Authentication Patterns

Security vs complexity trade-offs for different authentication approaches.

API Keys
Public APIs, rate limiting
Security: Low | Complexity: Low
OAuth 2.0
Third-party integrations, user consent
Security: High | Complexity: High
JWT Tokens
Stateless authentication, microservices
Security: Medium | Complexity: Medium
API Keys
Low Security

Header: Authorization: Bearer <api-key>

OAuth 2.0
High Security

Authorization code flow with PKCE

JWT Tokens
Medium Security

Header: Authorization: Bearer <jwt-token>

API Design Best Practices

RESTful Resource Design

Use HTTP verbs and resource-based URLs for clarity and consistency

✅ Good Examples
  • GET /users/123
  • POST /users
  • PUT /users/123
  • DELETE /users/123
❌ Bad Examples
  • GET /getUser?id=123
  • POST /createUser
  • POST /updateUser
  • POST /deleteUser

Error Handling

Proper HTTP status codes and detailed errors improve developer experience

✅ Good Examples
  • HTTP 400 with error details
  • Consistent error format
  • Helpful error messages
❌ Bad Examples
  • HTTP 200 with error in body
  • Generic "error occurred"
  • Inconsistent formats

Pagination

Efficient pagination prevents performance issues and improves UX

✅ Good Examples
  • Cursor-based pagination
  • Limit/offset with metadata
  • Link headers
❌ Bad Examples
  • Return all results
  • Page numbers only
  • No total count
Real-world API Examples

Stripe (REST)

Why: Payment APIs need to be simple, reliable, and widely compatible

Excellent documentation, consistent patterns, comprehensive webhooks

GitHub (GraphQL + REST)

Why: Complex relationships between repos, users, issues need flexible querying

GraphQL for v4 API, REST for v3 backwards compatibility

Google Services (gRPC)

Why: Internal microservices need high performance and strong contracts

Cloud APIs, Spanner, Pub/Sub use gRPC for efficiency

Netflix (GraphQL Federation)

Why: 100+ microservices need unified API for mobile apps

Federated GraphQL gateway with service-specific schemas

📝 Test Your Knowledge

6 questions • Progress: 0/6