How to build · 09

APIs & Integrations

REST and GraphQL, webhooks, OAuth and OpenID Connect, payments, Telegram, CRM, 1C and reliable external APIs.

Read: 0 / 10REST & GraphQL GraphQL Webhooks OAuth 2.0 & OpenID Connect Payment Integrations Telegram Bots CRM Integrations 1C Integrations External APIs & Error Handling Integration Security

REST & GraphQL

Comparison✓
REST or GraphQL
REST serves data as resources with their own URLs, so browsers, CDNs and proxies can cache responses and errors show up in the HTTP status. GraphQL takes a request listing the fields it needs at a single endpoint and gathers related data in one round trip, but caching moves to the client, errors move into the response body, and the server must limit query depth and cost. REST suits public APIs, integrations and files; GraphQL suits several clients with different screens over connected data.
Intermediate · 14 min read

GraphQL

Tutorial✓
GraphQL: schema, queries and mutations
A GraphQL server consists of a schema and resolvers. The SDL schema describes the types, the Query and Mutation entry points and their arguments, while resolvers are functions that return field values from a database or other services. The client sends POST /graphql with the operation text and variables and gets back JSON of the same shape. To survive arbitrary queries, the server loads relationships in batches with DataLoader and limits query depth and cost before execution.
Intermediate · 11 min read · practice ~1.5–3 h

Webhooks

How-to✓
Webhooks: receiving, signatures, retries and idempotency
A webhook is an HTTP request in which an external service tells your server about an event on its own: a payment succeeded, an order changed. A reliable receiver verifies the HMAC signature over the raw body and a timestamp, stores the event by its id, answers 2xx right away and processes the event in the background. A repeated delivery with the same id must not run the action twice, and an older event must not overwrite a newer state.
Intermediate · 12 min read · practice ~1–2 h

OAuth 2.0 & OpenID Connect

Deep dive✓
OAuth 2.0 and OpenID Connect: signing in with another account
OAuth 2.0 is a delegation protocol: the user lets an application act on their behalf without handing over a password, and the application receives an access token with a limited scope. OpenID Connect adds sign-in on top: the ID token states who signed in, and it must be validated — iss, aud, exp, nonce and the signature. The default flow today is Authorization Code with PKCE; per RFC 9700, the implicit and password grants are not used.
Intermediate · 12 min read

Payment Integrations

How-to✓
Payment integration: flow, statuses and webhooks
A reliable online payment follows the same pattern with any provider: the server creates a payment with an idempotency key, the customer pays on the provider’s page, and the order becomes “paid” only after a signed webhook and a status check through the API. Order statuses are governed by a state machine in which a repeated event changes nothing and an impossible transition raises an alert. Scheduled reconciliation finds payments whose webhook got lost.
Intermediate · 12 min read · practice ~2–4 h

Telegram Bots

Tutorial✓
Telegram bot: Bot API, commands and a webhook
A Telegram bot is a program that receives updates from Telegram’s servers and responds with Bot API calls over HTTPS using a token from @BotFather. Updates arrive either through getUpdates (long polling — handy during development) or through a webhook to your HTTPS endpoint that checks the secret_token header. In this tutorial a bot on Node.js 24 and grammY takes a request through buttons and forwards it to a manager, and it is verified by tests without a real token.
Beginner · 8 min read · practice ~1.5–3 h

CRM Integrations

How-to✓
CRM integration: adapter, field mapping, synchronisation
A website-to-CRM integration is built as an adapter behind a port: the application core hands over a lead in its own format, and the adapter translates it into calls to a specific CRM — in this guide, the amoCRM REST API v4. Reliability comes from four decisions: field mapping by ids from the account settings, duplicate search by normalised phone and email, an exchange log with idempotent retries, and two status sync channels — webhooks plus periodic reconciliation.
Intermediate · 12 min read · practice ~1–2 h

1C Integrations

How-to✓
1C for developers: HTTP services and OData
1C:Enterprise exposes two HTTP entry points to external systems. The standard OData interface is an automatic REST API over OData 3.0 for every object included in it: no coding required, but broad and tied to the configuration's structure. HTTP services are a custom REST API that a 1C developer defines in the configuration: a narrow contract with business logic inside 1C. Reference data is convenient to read via OData; orders and rule-driven operations go through an HTTP service with an agreed contract.
Intermediate · 12 min read · practice ~1–2 h

External APIs & Error Handling

How-to✓
External APIs: timeouts, retries, rate limits and graceful degradation
Every call to a third-party API needs a per-attempt timeout and an overall deadline; retry only transient failures (network, timeout, 408, 429, 5xx) and only for idempotent requests, with exponential pauses, random jitter and respect for the Retry-After header. If the service stays down, a circuit breaker stops calling it and the application answers from a cache or with an honest fallback instead of failing its own pages.
Intermediate · 12 min read · practice ~1–2 h

Integration Security

Fundamentals✓
Integration security: keys, signatures, least privilege
Every integration is a new way into your system and a new key that can leak. The baseline: a separate least-privilege key per integration and environment, planned rotation with an overlap between the old and the new key, checking the signature, freshness and schema of every incoming event, requesting user-supplied URLs only after the destination address is checked (SSRF), and logs without tokens or personal data. Partner data gets the same strict validation as user input.
Intermediate · 11 min read

Learning paths with this direction

APIs and integrations · 8 →← All directions

Tell us about your task — we'll review your request and get back to you

Got a project?
We'll scope and estimate it — for free.

Tell us about the product or the problem. After reviewing the task we'll come back with an architecture, a timeline and a price for the first version.

Scope and risks estimated before we start
NDA — yours or ours
Work starts within a week

Message on WhatsApp