API Client-Server Model — Separation of Concerns in Practice

In this tutorial, you will learn about API Client. We cover key concepts, practical examples, and best practices to help you master this topic.

The client-server model in APIs separates the user-facing application (client) from the data-processing backend (server), allowing both to evolve independently as long as the API contract remains stable.

What You'll Learn

• How the client-server model enables scalable System Design
• The responsibilities of clients versus servers in an API architecture
• Why Separation Of Concerns is a fundamental REST constraint

Why It Matters

Separation lets DodaTech update the Durga Antivirus Pro mobile app without changing the backend API, or scale the backend to handle millions of devices without modifying client code.

flowchart LR
    subgraph "Client Layer"
        A["Web Browser"]
        B["Mobile App"]
        C["Desktop App"]
    end
    subgraph "API Gateway"
        D["REST API"]
    end
    subgraph "Server Layer"
        E["Auth Service"]
        F["Threat Database"]
        G["Scan Engine"]
    end
    A --> D
    B --> D
    C --> D
    D --> E
    D --> F
    D --> G
    style D fill:#dbeafe,stroke:#2563eb

Real-World Use

The Durga Antivirus Pro dashboard runs as a web app (React client) and a mobile app (Swift/Kotlin client). Both communicate with the same backend API. The backend team can optimize threat detection algorithms without asking users to update their apps, because the API contract stays the same.

Code Examples

# Client code - only needs the API endpoint
import requests

API_BASE = "https://api.example.com/v1"

def get_user(user_id):
    response = requests.get(f"{API_BASE}/users/{user_id}")
    return response.json()

# Server code - handles business logic
from flask import Flask, jsonify

app = Flask(__name__)

@app.route("/api/v1/users/<int:user_id>")
def get_user(user_id):
    user = database.find_user(user_id)
    if user:
        return jsonify(user.to_dict()), 200
    return jsonify({"error": "Not found"}), 404

// Client in Node.js
const fetch = require('node-fetch');

async function getUser(id) {
  const res = await fetch(`https://api.example.com/v1/users/${id}`);
  return res.json();
}

Common Mistakes

1. Mixing Client and Server Logic

Putting business logic in the client destroys the separation benefit.

2. Changing API Contracts Frequently

Frequent breaking changes force client updates and frustrate developers.

3. Tight Coupling Through Shared Database

Clients should never access the database directly — only through the API.

4. Overloading the Client with Security Logic

Authentication and authorization belong on the server, not the client.

5. Ignoring Network Failures

Clients must handle timeouts, retries, and degraded network conditions.

Practice Questions

1. What problem does the client-server separation solve?
2. Can a single API server serve many different clients?
3. What is the API contract between client and server?
4. How does client-server separation improve security?
5. What happens if the server changes its internal implementation?

Answers:

1. It allows independent evolution of frontend and backend.
2. Yes, one API can serve web, mobile, and desktop clients.
3. The API specification — endpoints, formats, authentication, status codes.
4. The database is never exposed directly to clients; all access is mediated through the API.
5. As long as the API contract is unchanged, clients continue working without modification.

Challenge: Design an API client-server system where the client is a React dashboard and the server is a Python Flask app. Draw the architecture showing data flow.

FAQ

What's Next

Dive into the Request-Response Cycle to see exactly how clients and servers exchange data, then explore API vs Webpage to distinguish API endpoints from regular web pages.