Most APIs need more than a bare URL — a search term, a page number, an API key. That extra information travels as query parameters and headers.

Query parameters

Parameters go after a ? in the URL, joined by &:

https://api.example.com/search?q=python&limit=10&page=2

You could build that string yourself, but don't — spaces, &, and non-English characters all need encoding. Pass a dictionary as params and requests handles it:

import requests

params = {"q": "python programming", "limit": 10}
response = requests.get("https://api.example.com/search", params=params)

print(response.url)

The space in "python programming" becomes %20 automatically. This is also a security matter: hand-built URLs are how injection bugs get in.

Seeing the encoding

You don't need the network to see how parameters are encoded — urllib.parse is standard library and does the same job:

from urllib.parse import urlencode

params = {"q": "python programming", "limit": 10, "sort": "stars & forks"}
print(urlencode(params))

Headers

Headers carry metadata about the request rather than the data itself:

import requests

headers = {
    "User-Agent": "MyApp/1.0",
    "Accept": "application/json",
}
response = requests.get("https://api.example.com/data", headers=headers)

Common ones:

| Header | Purpose | | --- | --- | | User-Agent | identifies your program — some APIs reject requests without one | | Accept | the format you want back | | Authorization | your credentials | | Content-Type | the format you're sending (lesson 8.4) |

Authentication

Most APIs need a key. The usual form is a bearer token in the Authorization header:

import requests

headers = {"Authorization": "Bearer YOUR_TOKEN_HERE"}
response = requests.get("https://api.example.com/private", headers=headers)

Some APIs instead take the key as a query parameter:

import requests

response = requests.get("https://api.example.com/data", params={"api_key": "YOUR_KEY"})

Never hardcode a key

This is the single most important habit in this module:

API_KEY = "sk_live_abc123realkey"

Commit that and your key is public — bots scrape GitHub for exactly this, often within minutes. Read it from the environment instead (lesson 7.7):

import os

api_key = os.environ.get("MY_API_KEY")

if not api_key:
    print("Set MY_API_KEY first")
else:
    print("Key loaded")

Set it in your shell before running:

export MY_API_KEY="your-key-here"
python main.py

Add any file holding secrets (like .env) to .gitignore. If you do leak a key, revoke it immediately — deleting the commit isn't enough, it's already in the history and in caches.

Try it yourself

Build encoded parameters and assemble headers, without needing the network.

Checkpoint

• Pass query parameters as a params dictionary; never build the URL by hand.
• Headers describe the request — User-Agent, Accept, Authorization.
• Bearer tokens go in the Authorization header.
• Never hardcode API keys. Read them from environment variables and gitignore secret files.
• A leaked key must be revoked, not just deleted from the code.