API development and testing platform — build, mock, document and monitor APIs with a collaborative workspace and native Git support.
Pricing: 0 USD · Updated 2026-09-03
developmentYes. Postman's Free plan covers the core API client, specs, mock servers, collection/performance runs and manual Flows. Solo ($9/month) and Team ($19/user/month, billed annually) add automation, collaboration and RBAC (checked 2026-09-03).
Postman is an API development and testing platform — you build, mock, document and monitor APIs in a collaborative workspace with native Git support, used across the full API lifecycle from design to production monitoring.
What an API is, how REST APIs work over HTTP, the methods you'll actually meet — GET, POST, PUT, PATCH, DELETE — and how to read a response.
What HTTP request methods are, what each one does, and the difference between GET, POST, PUT, PATCH, DELETE and the rest — with safe vs idempotent.
Learn to create a production-ready RESTful API using Node.js and Express: setup, routing, middleware, environment variables, error handling, and deployment best practices — with a practical CRUD example for managing resources.
Cross-Origin Resource Sharing (CORS) is the mechanism browsers use to allow or block requests between different origins. This guide explains how CORS works, why it exists, common errors, and how to fix them.
An API gateway is a single front door for all client requests to your back-end services. This guide explains what an API gateway does, the problems it solves, common patterns, and how to choose one.
Step-by-step implementation of JWT authentication on a Node.js/Express API: password hashing, login endpoint, token verification middleware, refresh tokens, and the common security pitfalls.
Rate limiting protects Node.js APIs from abuse and overload. This guide explains fixed window, sliding window, and token bucket algorithms, shows how to add rate limiting to an Express API, and how to test it.
A webhook is a user-defined HTTP callback: one service sends an HTTP request to a URL you control when an event happens. Learn how they work, how they differ from polling and regular APIs, and how to verify signatures and handle retries safely.
The Web Crypto API gives every browser a built-in cryptography engine. Learn how to hash data, sign and verify messages, and encrypt or decrypt content using SubtleCrypto — with practical code examples and security notes.
GraphQL is an open-source query language for APIs that lets clients request exactly the data they need. This guide explains how GraphQL works, its type system, queries and mutations, and how it compares to REST.
REST and GraphQL are two ways to build web APIs. REST uses fixed endpoints and HTTP methods; GraphQL uses a single endpoint where clients query exactly the fields they need. Compare the trade-offs and learn how to choose.
REST and gRPC are two ways to build APIs. REST uses HTTP and JSON with universal browser support; gRPC uses HTTP/2 and Protocol Buffers for binary efficiency and code-generated stubs. Compare the trade-offs and learn when to choose each.
GraphQL and gRPC are two modern ways to build APIs. GraphQL lets clients query exactly the fields they need over a single HTTP endpoint; gRPC calls typed remote methods over HTTP/2 with binary Protocol Buffers. Compare the trade-offs and learn when to choose each.
JSON (JavaScript Object Notation) is an open, language-independent, text-based data interchange format derived from JavaScript object syntax. It represents data as a small set of types — objects, arrays, strings, numbers, booleans, and null — and is the de facto format for web APIs, configuration files, and data exchange between servers and clients. This guide explains JSON's syntax, its data types, how it compares to XML and YAML, and how to parse and generate it.
OAuth 2.0 is an open standard for delegated authorization defined in RFC 6749. It lets a user (the resource owner) grant a third-party application (the client) limited access to resources on another server without sharing their password. This guide explains the four roles, the main grant types, the recommended authorization-code flow with PKCE, and the security best practices from RFC 9700.
A regular expression (regex or regexp) is a sequence of characters that forms a search pattern for matching and manipulating text. Built on a formal mathematical foundation and common to almost every programming language and tool, regex lets you validate input, find and replace text, extract data, and transform strings with a compact, declarative syntax. This guide explains what regex is, its core syntax, how it is implemented, and how to use it safely.
How to design a clean REST API: plural resource URLs, safe and idempotent HTTP methods, meaningful status codes, pagination, and error responses — with practical examples.
Cross-Site Scripting (XSS) lets an attacker run their own JavaScript in another user's browser. This guide explains how the three types work and the defenses that stop them.
Cross-Site Request Forgery (CSRF) tricks a logged-in browser into sending unwanted requests to a trusted site. This guide explains how the attack works and the defenses that stop it.
Server-Side Request Forgery (SSRF) lets an attacker abuse a server's own URL-fetching feature to reach internal systems and cloud metadata. This guide explains the attack and the defenses that stop it.
Node.js errors come in several asynchronous styles, and each has its own correct way to be caught. This guide explains try/catch for synchronous code, error-first callbacks, promise rejection handling, and the 'error' event for streams and event emitters.
Unit testing is the practice of testing the smallest testable parts of a program — functions, methods, or classes — in isolation. Learn what a unit test is, the arrange-act-assert structure, test doubles and mocking, the testing pyramid, and best practices for writing good unit tests.
What is a cron job? Learn how cron and crontab work, the five-field schedule syntax with examples, common use cases, and modern alternatives like systemd timers and managed schedulers.
The JavaScript event loop is the runtime model that lets single-threaded JavaScript run asynchronous code. Learn how the call stack, the task queue, and the microtask queue cooperate, and why Promise callbacks fire before setTimeout.
Protocol Buffers (protobuf) is Google's language-neutral, platform-neutral data serialization format. Define your data once in a .proto file, compile it, and get fast, compact binary output. Learn how protobuf works and when it outperforms JSON.
