API Services

API Services (also called Endpoints) define the external APIs your app can call through ProtectMyAPI. Each service specifies where requests go and how authentication is handled.

Service Types

Prebuilt Providers

One-click setup for 20+ popular APIs:

Custom Endpoints

Create your own endpoints for any REST API.

Creating a Service

Authentication Types

Configuring Authentication

1. Select the Auth Type
2. Choose the Secret containing your API key
3. For custom headers, specify the Header Name

Auth Type: API Key Header
Header Name: X-Custom-Auth
Secret: MY_API_KEY

Result: X-Custom-Auth: sk-abc123...

Service Settings

General Settings

Request Settings

Secret Binding

Link multiple secrets for complex auth:

Primary: OPENAI_API_KEY → Authorization header
Secondary: ORG_ID → OpenAI-Organization header

Using Services in Code

By Slug

// iOS - Call by slug
let response = try await ProtectMyAPI.shared.request(
    endpoint: "openai-chat",  // ← The slug
    method: .POST,
    body: [
        "model": "gpt-4o",
        "messages": [["role": "user", "content": "Hello!"]]
    ]
)

// Android - Call by slug
val response = ProtectMyAPI.request(
    endpoint = "openai-chat",  // ← The slug
    method = "POST",
    body = mapOf(
        "model" to "gpt-4o",
        "messages" to listOf(mapOf("role" to "user", "content" to "Hello!"))
    )
)

Using AI Provider Helpers

For prebuilt providers, use the typed helpers:

// iOS
let openai = ProtectMyAPI.openAIService()
let response = try await openai.chat(
    message: "Hello!",
    model: "gpt-4o"
)

// Android
val openai = ProtectMyAPIAI.openAIService()
val response = openai.chat(
    message = "Hello!",
    model = "gpt-4o"
)

Prebuilt Provider Reference

OpenAI

Required secret: OPENAI_API_KEY

Anthropic

Required secret: ANTHROPIC_API_KEY

Google Gemini

Required secret: GOOGLE_API_KEY

Stability AI

Required secret: STABILITY_API_KEY

Advanced Configuration

URL Parameters

For dynamic URLs, use path parameters:

Target URL: https://api.example.com/users/{userId}/data

Call with:

let response = try await ProtectMyAPI.shared.request(
    endpoint: "user-data",
    pathParams: ["userId": "123"]
)

Query Parameters

Add default query parameters:

Target URL: https://api.example.com/search
Default Query: format=json&version=2

Custom Headers

Add headers beyond authentication:

Troubleshooting

”Endpoint not found”

• Verify the slug matches exactly
• Check the service is linked to your app
• Ensure the service is enabled

”Authentication failed”

• Verify your API key is correct in Secrets
• Check the secret is linked to the service
• Confirm the auth type matches the provider’s requirements

”Target unreachable”

• Verify the Target URL is correct
• Check if the API requires whitelisting
• Review timeout settings

”Rate limited”

• The target API is limiting requests
• Check your plan limits with the provider
• Implement client-side rate limiting

Best Practices

Naming Conventions

✅ Good: openai-chat-production
✅ Good: stripe-payments
❌ Bad: endpoint1

Environment Separation

Create separate services for development and production:

• openai-chat-dev → Uses test API key
• openai-chat-prod → Uses production API key

Security

1. Use specific secrets per service (not shared keys)
2. Enable circuit breaker for unreliable APIs
3. Set appropriate timeouts
4. Monitor usage in Analytics

Next Steps