How APIs Work — a Plain-English Guide for Contractors

Every page in this directory grades how open a platform is — whether other software can talk to it. This page explains what that actually means, in jobsite terms, so you can judge any software pitch yourself. No jargon you can’t translate.

What an API actually is

An API is a service window. Your software — Jobber, ServiceTitan, QuickBooks, whatever runs your shop — keeps everything behind a counter: customers, jobs, invoices, schedules. An API is the window where another program can walk up, show its credentials, and ask for specific things in a specific format: “give me yesterday’s new leads,” “mark job 1042 complete,” “create an invoice for this customer.”

Without a window, the only way in or out is a person — someone at a keyboard, copying and pasting, exporting spreadsheets, re-typing. That’s why some shops can automate follow-up and some can’t: it’s not the automation tool, it’s whether the shop’s software has a window, and how wide it opens.

What an API key is

An API key is the badge that lets a program use the window. Think of it as a jobsite key card: the office issues it, it opens only certain doors, and if someone loses it, the office cancels that card — nobody has to change every lock in the building.

That last part is the whole point. A key is not your password. Your password opens everything, including payroll and banking. A proper API key opens only what it was issued for. When a vendor or an app asks for your actual account password instead of using a key or a sign-in approval screen (that’s called OAuth — you approve access on the vendor’s own page and can revoke it later), that is a red flag. Legitimate tools almost never need your password.

Webhooks vs. scheduled sync — the difference that decides “instant”

A webhook is a phone call. The moment something happens — a lead comes in, an invoice gets paid — the platform itself calls the other program and says “it happened, here’s the details.” Follow-up can start in seconds.

A scheduled sync is a delivery route. The other program drives by every 5 minutes, every hour, or once a night and asks “anything new?” It works, but there’s always a gap between the event and the reaction.

Why it matters: a new-lead text that arrives in 30 seconds books jobs. The same text arriving tomorrow morning is a courtesy. When a platform has no webhooks, “instant” automations built on it are really “eventually” automations — no matter what the salesperson called them.

Bridge apps: Zapier and Make

Bridge apps are general contractors for software. Zapier and Make sit between thousands of programs and pass information across: “when this happens in App A, do that in App B.” For simple jobs — a new lead lands in a spreadsheet, a text goes out when a form is filled — they’re genuinely useful and cheap.

Know their limits before you build a business on them:

• They only carry what both ends expose. If your platform doesn’t tell the bridge about invoice payments, no bridge recipe can react to an invoice payment.
• Most bridge connections poll — they check on a schedule (often every 5–15 minutes on paid plans), so “instant” usually isn’t.
• They’re rented, per-task. Every pass across the bridge counts against a monthly task allowance. A busy shop can outgrow the cheap tiers fast.
• They’re another account holding your keys. Fine when managed properly — but somebody has to own that account and its access.

In this directory, a Zapier or Make listing counts as evidence for the bridge rung only. It does not prove a platform has a real API.

Plan gates and the admin question

The most common surprise in this directory: the API exists, the docs are public — and your plan doesn’t include it. Vendors gate API access behind higher tiers, paid add-ons, or partner programs. It’s rarely mentioned on the pricing page’s main grid.

The second surprise: only an admin on the account can create API keys, approve connected apps, or turn the feature on. If your office manager’s login can’t see the settings page, the project stalls until the account owner shows up. Before any automation project, answer two questions: which plan are we on, and who is the admin?

Key security — five rules that keep you safe

• Scope it. If the platform offers permission levels (read-only, read/write, full), issue the smallest key that does the job. A tool that only reads job status never needs write access to invoices.
• Never hand over your password. Approvals happen on the vendor’s own sign-in page (OAuth) or with an issued key. A tool asking for your raw password gets everything, forever, until you change it.
• One key per tool. Don’t share one key across five apps. Separate keys mean one problem doesn’t become five.
• Know how to revoke. Before connecting anything, find the screen where connected apps and keys are listed and can be cut off. Test it. If you can’t revoke it, don’t grant it.
• Rotate after people leave. When an employee or vendor relationship ends, reissue the keys they touched. It takes ten minutes and closes the door completely.

The 5 questions to ask any software vendor before you buy

1. “Do you have a public API, and is it included in the plan I’d be buying?” Not “do you integrate” — integrations can mean one spreadsheet export or one partner. Ask for the developer documentation link.
2. “Does it have webhooks, or will my other tools have to check on a schedule?” This one answer tells you whether follow-up can be instant or will lag.
3. “What can the API write, not just read?” Many APIs happily show you data but won’t create a job, update a status, or send an invoice back. Read-only is a window you can look through but not pass work across.
4. “Who can create API keys — any user, or only the account admin?” And: “Can keys be scoped and revoked individually?”
5. “If I leave, how do I get all my data out?” Full export, in a usable format, without a support ticket and a waiting period. Your customer list is your business; the exit door matters as much as the entrance.

A vendor who answers all five cleanly is selling you a platform. A vendor who dodges them is selling you a cage with good marketing.