New: Roadmaps ordered paths through our cheat sheets and flashcards, so you always know what to study next.
Explore themSee what's new on GitHubFrom a single REST endpoint to a versioned, gateway-fronted API that can defend itself.
A 12-step learning path. Follow it in order, or jump to what you need.
For developers who can already build and run a basic backend service and want to get seriously good at designing the API itself: this path goes deep on REST, GraphQL, gRPC, authentication, and the security and reliability patterns that turn a working endpoint into a production API. Plan on about 6 to 10 weeks at a few hours a week. It skips picking a language, a framework, or a database, and deploying one to production; Backend Developer covers that ground broadly, while this path goes deep on the API contract itself. By the end you can design a REST API that survives versioning, implement OAuth and token-based auth, choose between REST, GraphQL, and gRPC for a given problem, and defend an API against the OWASP API Top 10 before shipping it behind a gateway.
Expected: basic experience building and running a backend service, comfortable with HTTP and at least one backend framework or language. Helpful but not required: some exposure to databases or a prior authentication implementation.
Gives you the resource-and-status-code vocabulary every later step assumes, from the versioning schemes in step 2 to the OWASP checks in step 11: read this once and an API response stops looking like magic.
Takes the REST contract from step 1 and asks the harder question: how do you change it later without breaking every client already depending on it.
This is where the auth question clicks, or doesn't yet: sessions, API keys, and tokens solve the same identity problem differently, and expect to revisit this table once step 4's OAuth flows force a real choice.
You can design resource-based endpoints, evolve them without breaking existing clients, and reason about which authentication scheme fits the job. Next up: turning that choice into a real OAuth flow.
Finish this section to unlock.
+100 XP
Turns the token trade-offs from step 3 into a real protocol: the specific grant type, PKCE, and scope choices that decide whether your API can safely support a mobile app, a partner integration, or an AI agent.
Shows what an API looks like when clients pick their own shape of data instead of hitting the fixed endpoints step 1 taught you to design, solving the over-fetching problem REST can't.
Swaps GraphQL's flexible queries from step 5 for the opposite trade-off: a strict binary contract built for service-to-service speed, the choice most microservices make once humans stop being the client.
Flips the request-response model from steps 1, 5, and 6 around: instead of a client asking, your API pushes an event the moment something happens, and signature verification is what keeps that push honest.
You can implement an OAuth flow, query with GraphQL, call a gRPC service, and push events through a webhook instead of waiting to be asked, with a few due flashcards from chapter 1 keeping REST fundamentals fresh while you're deep in these alternate styles. Next up: making all of it hold up once real traffic and real attackers show up.
Finish this section to unlock.
+100 XP
Take this if you want to see exactly what's inside the tokens step 4's OAuth flows hand out: the claims, signing algorithms, and expiry rules that decide whether a stolen token is a minor annoyance or a breach.
Guards every endpoint you've built since step 1, REST resources, GraphQL queries, webhook receivers, with the token bucket and sliding window math behind every 429 response before a spike or an abusive client takes them down.
Centralizes the auth from step 4 and the rate limits from step 9 behind one front door that also routes to your REST, GraphQL, and gRPC endpoints, the pattern every real API sits behind once it leaves a single service.
Audits everything you've built since step 1 against the OWASP API Top 10, the property-level authorization and excessive-data-exposure bugs that slip past the gateway in step 10 if nobody checks for them.
Proves the whole design holds up: contract tests that catch a broken response shape, security tests that catch what step 11 flagged, and the CI pipeline that runs both before anything ships.
You went from a single REST endpoint to a versioned, rate-limited, gateway-fronted API hardened against the OWASP API Top 10 and proven by contract tests. That's the API Design badge, earned: you can design, secure, and ship APIs other engineers actually want to build against.
Finish this section to unlock.
+100 XP
Finish every required step, at least 70% of them genuinely done (not skipped), to earn this badge and 500 XP.