Most useful sites lean on outside services: someone else takes the card payment, sends the SMS, draws the map or delivers the email. You connect to them through an API.
Connecting is easy to describe in chat; connecting safely takes a few habits. Here they are.
An API lets your site talk to another service, such as payments, SMS or maps. Keep keys as project secrets, call the service from the server side only, and verify every webhook before you trust it.
What an API key is, and where it must never go
An API key is a password for your account at that service. Anyone who holds it can spend your money or read your data, so it should never appear in chat, in the page's front-end code or in a public GitHub repository.
Store keys as project secrets and let the server read them. If a key leaks, revoke it at the provider and create a new one right away.
Call outside services from the server
Anything running in the visitor's browser can be inspected. So the call that uses a secret key must happen on your server, with the browser asking your server and your server asking the service.
Some keys are meant to be public, often called publishable keys, and are safe in the browser. Read the provider's documentation to see which kind you have.
- Use the provider's test mode first, with test keys.
- Handle failures: show a friendly message if the service is down.
- Respect rate limits so you are not blocked.
Webhooks: the service calls you
A webhook is the reverse direction: after a payment succeeds, the provider sends a message to a web address on your site. It is how your site learns that an order was really paid.
Because anyone could send a fake message to that address, verify the signature the provider includes, using a secret you store safely. Also handle the same message arriving twice without creating a second order.
Costs, limits and local rules
Many integrations are paid or have a free tier with limits. Payments, SMS and some map or AI services charge per use, and these are the provider's own prices, separate from building your site. Check them before launch.
If a service receives your customers' personal data, check where it is processed and mention it in your privacy policy. This is general information, not legal advice.
A prompt you can paste
"Connect my booking site to an SMS provider to send confirmation messages. Read the provider key from a project secret, call it only from the server, add a test mode switch, and show a friendly error if sending fails. I will add the key as a secret myself."