API Maker is a program that runs on a server. Your apps call it over the internet. It talks to your databases and runs your own code. This page shows each part once, in simple words, so the rest of the docs make sense.
In short
Your app calls a URL. API Maker checks who calls, runs the API, and answers in JSON.
Every table gets ready-made APIs. Your own logic goes in custom APIs and hooks.
Each app has a login : an API user. Its groups list what it may call.
Your code runs in sandboxes : small containers, apart from API Maker.
Ready-made tools : tokens, encryption, the cache, indexes.
Your code can also run without a URL : hooks (before or after an API), events (after something happened), schedulers (on a timer) and WebSocket events (live messages to your apps).
In a URL, admin is the user path of the account which owns the APIs. The first account of a new installation has admin. Each developer account has a path of its own. All APIs at a glance lists every API with its URL.
The API gate : which app. Each app gets an API user : a username and a password. The app trades them for a token at the token API, then sends the token on every call. The groups of the API user list the APIs, tables and fields it may use. See API users and groups.
The row gate : which person. When people sign in to your app, a second token says who the person is, in x-am-user-authorization. A pre hook then keeps each person to their own rows. See sign-in of your users.
A new account starts with an API user default and a group Default, which allows everything. The password of default is kept in the default secret, at common.apiUserPasswords.default. It is empty on a new account, unless your installation sets one : type one there before you ask for a token. Before you go live, replace both : one small group per screen of your app, as Handle role based permissions shows.
Some APIs need no token at all : set their access to public (IS_PUBLIC) in their settings.
In a sandbox, by default. A sandbox is a Docker container, apart from API Maker. Each language has its own sandboxes, and API Maker starts more of them when many calls come. A call has a time limit : 13 seconds unless you set another. See Sandbox settings.
On the machine, when you ask. Code marked Run on native process runs next to API Maker, without Docker. It is faster and less isolated : use it for a browser with Playwright, or the lowest delay. See native process.
In eight languages. TypeScript (on Node.js or Bun), Python, PHP, C#, Go, Rust, Java and Kotlin. See Languages.
With one object, g. Your code gets the request (g.req), the answer (g.res) and every API of API Maker (g.sys.db, g.sys.system, g.sys.cache). See the global object g.
You write the code in the admin panel, with completion of your tables and fields. Or in your own editor : the local client keeps a folder in sync, both ways.
A schema API checks a row before it reaches the database. It trims spaces, fixes types and fills default values, then runs the rules of the schema and your own checks. When something is wrong, you get 400 with every problem at once, and nothing is saved. See Table schema.
Your schemas, APIs, code and settings are files. The admin panel commits them to a Git repository, and another server pulls them : that is how a change ships. Secrets never go to Git. See Git integration.