Also commonly, with Web apres, you're going to need some form of token to authenticate yourself with this AP I, which will allow the application to know whose access in the A P I in order to limit what that person can access based on their specific permissions.