Zero for us at http://api.case.law because most of our endpoints don't require registration. Getting case text does require fast free registration, though.
What’s your API’s “Time To 200”?
71–80 of 90 posts
Re: What’s your API’s “Time To 200”?
#72Zero for us at http://api.case.law because most of our endpoints don't require registration. Getting case text does require fast free registration, though.
Thanks for the link - this is super cool! I definitely plan to explore.
Re: What’s your API’s “Time To 200”?
#73Earlier quoted context omitted.
I seriously discount your api if I can't do my initial review via curl. As the author stated, having to do all this setup creates friction, your api is supposed to be solving a problem for me. If it just creates different problems you're not offering a good solution. If I can quickly see how it works via curl it will be that much easier to evaluate.
Also please have an example API key that actually works. There are some ways to do this depending on your use case - Have a rotating example key in your docs that rotates once a week. - Have the example API key return redacted data, example data, or old data instead of real data instead of failing out as an invalid key. - Add something to the response that doesn't make it usable in production (e.g. a TTS API response…
Agreed, extra credit when the docs use the key from your account so that you can just grab strait from the docs, I think it's stripe who I'm thinking of who does that, sooooo nice.
Re: What’s your API’s “Time To 200”?
#74Most companies seem to maintain two APIs: a “private API” that they use to actually to deliver their website or service, and a second “developer API” for the exclusive use of third party services. If you’re just interested in putting together a quick hack or proof of concept, the private API often has a “time to 200” orders of magnitude faster than the public developer API: pop open the Network tab on your browser, p…
Many companies only have one API, and sadly it’s just the private one.
If it's reachable by your computer and it has the right credentials for it, it's not really "private".
Re: What’s your API’s “Time To 200”?
#75Earlier quoted context omitted.
True and if this API handled user data or anything substantially private that would be a HUGE deal and super dangerous. But it seems like in this case it's mostly a rate limiting and identification exercise and not a secure protection of user data so the impact of exposure is substantially lower. So it does seem reasonable here. Though I hope that OP has documented all over the place "do as I say not as I do" so peop…
dmlittle's concern is a valid one and for most other types of API I would definitely agree it's not the right approach. I still think it's reasonable for my use case but perhaps I should add another auth scheme as an optional alternative for the user who is concerned about their key potentially being caught in logs. Your point about the documentation is also a good one - I should probably add a specific page just abo…
FWIW you can add HTTP Basic Auth information in URL links and all major browsers and other HTTP clients (for the most part) should interpret it correctly.
https://:[API_KEY]@v6.exchangerate-api.com/v6/latest/USD
If you only have an API key and not a token (username) and secret (password) I recommend passing the API key as a password as some logging solutions do log the basic auth username in the data recorded.
Re: What’s your API’s “Time To 200”?
#76Personally, few things annoy me more than APIs that can only be accessed via an SDK, and can't easily be called through e.g. cURL.
famous example of this, are most of the aws api's that because of their signing features and hashes can really only be called sanely from an sdk. such a pain to debug, i'm not sure why they have such signing features. is it for security
I would say it is fair for AWS to have a complicated signing method, because you really do not want your AWS account falling into the wrong hands or being intercepted through some MITM attack. With an AWS account an attacker can bankrupt you pretty much instantly.
Re: What’s your API’s “Time To 200”?
#77Earlier quoted context omitted.
Many companies only have one API, and sadly it’s just the private one.
If it's reachable by your computer and it has the right credentials for it, it's not really "private".
This is fine for toy projects but not for commercial applications. Consuming private APIs without permission and making money from them leads to lawsuits.
Re: What’s your API’s “Time To 200”?
#78I've put a fair amount of work into getting this exact time as low as possible for my exchange rates API [1]. I've noticed slightly better conversion each time I've taken a major step out of the process. I've specifically eliminated some of the steps this article cites in its example of a tedious flow - for instance I changed user accounts to be confirmed by default and then only disable them retroactively if a user…
[deleted]
Re: What’s your API’s “Time To 200”?
#79I don't want to require API keys (or payment) for read access to public data.
It is acceptable to not provide support unless you pay, and to allow more requests in a time period if you sign up. (This seems to be the case for the exchange rate API mentioned in another comment, so that is OK.)
Re: What’s your API’s “Time To 200”?
#80We’re at 0s!