API Technology Trends in 2021
As companies look to build scalable, flexible software, they are increasingly turning to API-driven development. A well-built API allows you to provide core services to internal stakeholders or customers without locking them into a specific user interface.
In 2021, APIs need to be optimized for performance, providing secure and reliable real-time data access. New formats and protocols like GraphQL and gRPC are giving developers more options for delivering APIs that are developer-friendly, secure, reliable, and easy to integrate, but they introduce plenty of their own challenges.
Keeping pace with the many different technology trends in software development is a big job in itself. Understanding these emerging API trends and how they will affect your next product is one of the many things you need to worry about as you progress through your career as a developer.
In the first part of this article, I’ll share a few of the key API technology trends you should watch for in 2021. I’ll offer some insight into each and how you can lean into these trends to build better, faster, more flexible software. In the second part of the article, I’ll share some of the emerging technologies being used to realize these trends. You’ll learn more about how the next generation of APIs is being built, tested, and scaled.
1. Real-Time Data Synchronization
API consumers increasingly want immediate results, so real-time data access is essential. Some tasks, like booking an Uber or ordering a pizza, are relatively easy to build with traditional REST-focused patterns, but other problems like fraud detection and reporting can be more complicated to solve in real-time.
For some industries, real-time API delivery is a mission-critical service. In inventory management, providing real-time notifications when an item is available to buy might be the difference between making the sale or losing a customer.
Finally, real-time data synchronization is essential for many internal processes too. Internal reports and admin dashboards may need to be updated in seconds to ensure fast and correct business decisions.
2. Global Performance
Real-time data access in an API would be relatively simple except for the fact that API consumers expect peak performance from any location around the world. This means that your API needs some form of caching and that caching introduces the likelihood of data getting out of sync. Hence, the trend towards performance optimization.
As the primary interface for many services, APIs need to be optimized at a global scale. Consumers (whether internal or external) expect fast response times, so measuring API performance is essential. Once performance metrics are in place, you can employ techniques such as caching, payload limits, rate limiting, and others to optimize the API.
Stress testing your API with real-world scenarios can help you catch performance issues in the development phase, minimizing problems when it eventually goes live. This is why load testing tools are becoming so popular and varied, especially in the API-centric Kubernetes space.
3. Improved Security and Better Third-Party Options
As APIs are more widely used and distributed, their attack surface areas tend to grow. The complexity and variety of APIs used by many organizations only increase the security risk:
“Simply put, it’s impossible to secure what you don’t know about. But all too often, organizations simply don’t have any idea what’s running on their networks. Companies added security tools in a one-off fashion… What’s more, traditional tools were not built with the modern, decentralized enterprise in mind and often cause more problems than they solve.”
Of course, some services are more sensitive to security issues compared to others, but the trend in API development seems to be pushing towards increased awareness and focus on security.
Traditionally, APIs included authentication and rate limits as baseline security measures. Now, developers must do more to combat complex DDoS attacks, authorization errors, and unintentional data exposure.
There are a lot of tools and services now evolving to protect your API from common security attacks, and many are now starting to use artificial intelligence to provide even better protection for your APIs. While building solutions in-house may be tempting, it’s typically not a good idea to roll your own security from scratch.
4. Widespread Adoption of Microservices
Microservices are now a core focus when building APIs. While once a buzzword in the tech industry, they’re clearly here to stay. In an ideal world, microservices will help with scalability, flexibility, and security. Of course, they also introduce their own challenges for API developers.
For example, API gateways are an essential part of microservices. They will forward requests to the respective services based on routing rules you configure. Authentication and security checks are often done in the API gateway so that duplication is not required for each service. If not implemented correctly, this can introduce a single point of failure into your API, so it’s not something to be adopted without care.
Microservices also need to communicate with each other internally. Historically, this communication has been done using REST APIs. Nowadays, microservice communication is trending toward gRPC and event-driven architectures, given their speed and reliability (as we’ll discuss in the next section). Latency can be a major issue for microservices, so the transition away from REST makes sense, but these new networking protocols are less established and supported.
Technologies Powering These Trends
As API developers focus on real-time data synchronization, global performance, security, and the adoption of microservices, open source and proprietary tools are being developed to facilitate these trends. Here are a few of the most notable API development tools emerging today.
GraphQL
GraphQL is a query language for APIs. In REST API development, you must create endpoints that restrict users to specific data to be included in each call. Using GraphQL, the client can request any number of resources — you just define the types and fields. In most cases, this means consumers make fewer requests and get the data they need faster.
“The biggest difference with REST is that just one trip to the server is needed in GraphQL, which makes the data fetch faster. The response to a GraphQL query is sent back as JSON. In the REST model of fetching data, multiple round trips to the server are often needed to get all of the data an application requires — so it can be slow, especially on a mobile device.”
— Richard MacManus, The New Stack
For example, let’s say the client requests a user resource. If they also want to get the comments made by the user, they can do so in one request. This saves development time on your side, as you don’t need to build multiple endpoints with different formats, but it also saves time for users who only have to make one request. GraphQL is also relatively easy to implement and maintain thanks to powerful developer tools (like Apollo) that can connect to an existing data store.
gRPC
gRPC is a modern, open source, high-performance Remote Procedure Call framework. It can be run on any environment and can be used to communicate across backend, frontend, and mobile devices.
gRPC’s speed and cross-platform support are key strengths, particularly given the rising popularity of microservices. In many microservice architectures, a request needs to be made to multiple services to compile the response. Response times can get slow because of network calls, and gRPC helps to reduce this latency.
gRPC uses protocol buffers for binary serialization instead of JSON. This makes gRPC fast — even with a large payload of data. In fact, gRPC is roughly seven times faster than REST API calls, plus it has built-in HTTP/2 protocol support. Finally, instead of relying on individually defined API endpoints like REST, gRPC provides an auto-generated SDK that clients can use to make calls to the service.
REST: Tried and Tested, But What’s New?
REST APIs have been around for a while, and to be honest, REST isn’t going away anytime soon. Because it’s widely used and understood, most common problems have already been solved, and it’s gotten better over the past few years thanks to innovations in the HTTP protocol.
HTTP/1 had a request blocking problem where only one request could be processed at a time. Using REST with HTTP/2 gives you the power of multiplexing, where multiple HTTP requests and responses can be active at the same time. In HTTP/1, multiple connections would be required for parallelism, whereas HTTP/2 can achieve parallelism with just one.
Web Push API
The Web Push API allows your API server to send information to the client proactively. This is mostly used for time-sensitive data that you want to be reflected in the user interface as soon as possible (like notifications or alerts). Users don’t have to refresh the browser just to see the latest updates.
The Web Push API can even deliver messages to users who are temporarily offline. While often used in conjunction with traditional asynchronous protocols (like webhooks or email notifications), widespread use of the Web Push API is opening up new avenues for real-time communication to API consumers.
Conclusion
The software industry evolves quickly, and every developer has to find ways to keep up. New technologies allow API developers to build performant, highly available, secure applications more easily. They also offer API consumers more options for integrating them.
More than ever, the big challenge is picking the right technology for the right use case. For example, a real-time chat API might be a great candidate for gRPC, while a social network API might lean on GraphQL. Similarly, a notifications API might use push notifications to alert users, while a simple two or three endpoint application might limit its offering to a more traditional REST API.
As the variety of APIs being offered grows, API technology will continue to evolve accordingly. The rise in video streaming, cloud native technology, and edge computing might all push the industry in new directions that are hard to predict.
