REST & GraphQL APIs
APIs that keep working after the demo.
Calling an API is easy. Handling expired tokens, rate limits, retries and duplicate webhooks is where most integrations quietly fail.
The problem
An integration works for weeks, then a token expires and nobody notices. A webhook fires twice and creates two orders. A rate limit kicks in during a busy hour and records go missing. None of this shows up in testing.
We build and fix APIs with the failure cases in mind: authentication that refreshes, retries that do not duplicate, errors that get logged somewhere a person will see them. If you want a business-level connection between two tools, our API integrations service covers that. This page is about the API work itself.
Typical jobs
Small REST or GraphQL endpoint
Build a defined endpoint or set of endpoints for your app, site or partner.
Webhook receiver
Accept webhooks safely, verify signatures and process each event once.
OAuth or token auth fix
Repair logins and token refresh so connections stop dropping.
Rate limits and retries
Add backoff, queues or batching so calls succeed under load.
Consume a third-party API
Connect your code to an external API with proper error handling.
API documentation
Write clear, current docs for an API your team or partners rely on.
What you get
- Working endpoints or client code, committed to your repository
- Signature checks, auth handling and input validation
- Error logging and retry behaviour that suits the job
- Tests covering the main success and failure cases
- Plain-English notes on how it works and what to watch
What this isn’t
- Large public API platforms with versioning programmes
- Scraping sites that do not permit it
- Holding production secret keys on our side after handover
Scoping agent
Tell us what’s stuck.
Two minutes of guided questions. You get a plain-English brief, and a developer replies within one business day.
- Guided questions, not an AI chatbot
- A person reviews every brief
- Never asks for passwords or keys
No account. No sales script. Never asks for passwords or keys.
Questions
REST or GraphQL — which should we use?
Whatever fits what already exists. For most small jobs that means matching your current stack, not introducing a new one. We explain the trade-off if there is a real choice to make.
How do you handle API keys?
You create a restricted key or an invited account with only the access the job needs. Keys live in your environment settings, never in the code or in an email.
Can you fix an API someone else built?
Yes. We read it first, find the failure, and fix it in the existing style unless there is a good reason not to.
Related services
Further reading
- Adding AI to your business without the chatbot trapAI · 6 min read
- Is your contact form actually delivering? How to check, and the usual fixesFixes · 6 min read
- What a small website fix costs in Australia, and what changes the pricePricing · 6 min read