API Integration

Introduction

Most useful agents integrate with external APIs — Salesforce, Stripe, GitHub, Slack, internal services. Wrap each API as a typed tool with auth, retries and idempotency.

Beginner analogy: the agent's hands are APIs — give them gloves (validation), training (descriptions) and safety nets (retries).

Understanding the topic

Core concepts:

• Wrap each endpoint as a single tool function.
• Inject auth tokens server-side, never via the LLM.
• Idempotency keys for mutating calls.
• Per-tool timeouts and retries.
• Use OpenAPI / MCP to auto-generate tool schemas.

Syntax reference

Visual workflow / architecture:

LLM → tool: stripe_refund(orderId, amount)
       │
       ▼
   validator → auth inject → idempotency key → call Stripe
       │
       ▼
   result → LLM

Real-world use

Zapier's AI Actions, Composio, Arcade.dev — all expose libraries of pre-wired APIs as tools.

Best practices

• Centralise auth — never trust LLM with secrets.
• Use idempotency keys for every mutation.

Common mistakes

• Leaking secrets into prompts — instant CVE.

Hands-on exercise

Interview preparation — practice these questions:

• Q1. Why never expose API keys to the LLM?
• Q2. Idempotency key — what and why?
• Q3. Scenario: API rate-limits cause cascading retries. Fix?