Stop Confusing SDK and API: The Difference Finally Explained (With Real-World Examples)

SDK vs API: Explained with a Real Example (Manual Backend vs Supabase)

If you are learning backend development, you have probably heard two words a lot: API and SDK. Many beginners think they are the same thing. They are not.

In this article, we will understand the difference in very easy English, using a real example: building a simple "Sign Up" feature.

• First, we will build it the manual way (like making our own backend with Express.js and a database).
• Then, we will build the same thing using Supabase, which gives us a ready-made SDK.

By the end, you will clearly understand: What is an API? What is an SDK? And how SDK makes life easier?

---

1. What is an API? (Simple Explanation)

API means Application Programming Interface.

Think of an API like a waiter in a restaurant.

• You (the frontend app) do not go inside the kitchen (the server/database) yourself.
• You give your order to the waiter (the API).
• The waiter goes to the kitchen, gets your food, and brings it back to you.

In technical words: An API is a set of rules that lets two applications talk to each other. Usually, this means sending a request (like "give me user data") and getting a response back (like the user data in JSON format).

A simple API call looks like this:

POST https://myapp.com/api/signup
Body: { "email": "[e-mail]", "password": "12345" }

You are just sending a raw HTTP request. No special tool is required — you could even do this with a simple fetch() call, or using a tool like Postman.

---

2. What is an SDK? (Simple Explanation)

SDK means Software Development Kit.

Think of an SDK like a ready-made toolbox.

Instead of writing raw HTTP requests by hand (like calling the waiter yourself every time in a very formal way), the SDK gives you pre-written functions that do the API calling FOR you, behind the scenes.

So instead of writing this:

fetch("https://myapp.com/api/signup", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({ email: "[e-mail]", password: "12345" })
})

An SDK lets you simply write:

supabase.auth.signUp({ email: "[e-mail]", password: "12345" })

Same result. Much easier to write.

Key point to remember:

An SDK is built ON TOP OF an API. The SDK is just a helper library that calls the API for you, so you don't have to write raw requests yourself.

---

3. Real Example: Manual Backend App (Building Sign Up Yourself)

Let's say you want to build a "Sign Up" feature completely by yourself, without any tool like Supabase.

You will need to do ALL of these steps manually:

1. Set up a server (Express.js)
2. Connect to a database (like PostgreSQL)
3. Write a route to accept sign-up data
4. Hash the password yourself (never store plain passwords!)
5. Save the user in the database
6. Create a login token (JWT) yourself
7. Send the response back

Here is what that looks like in code:

// server.js - Manual backend using Express.js

const express = require("express");
const bcrypt = require("bcrypt");
const jwt = require("jsonwebtoken");
const { Pool } = require("pg"); // PostgreSQL connection

const app = express();
app.use(express.json());

const db = new Pool({
  connectionString: "postgres://user:password@localhost:5432/mydb"
});

// Manual Sign Up Route (this itself IS an API endpoint)
app.post("/api/signup", async (req, res) => {
  const { email, password } = req.body;

  try {
    // Step 1: Hash the password ourselves
    const hashedPassword = await bcrypt.hash(password, 10);

    // Step 2: Save user to database ourselves
    const result = await db.query(
      "INSERT INTO users (email, password) VALUES ($1, $2) RETURNING id, email",
      [email, hashedPassword]
    );

    const newUser = result.rows[0];

    // Step 3: Create a login token ourselves
    const token = jwt.sign({ userId: newUser.id }, "SECRET_KEY", {
      expiresIn: "7d"
    });

    // Step 4: Send response back
    res.status(201).json({ user: newUser, token });

  } catch (error) {
    res.status(500).json({ error: "Something went wrong" });
  }
});

app.listen(3000, () => console.log("Server running on port 3000"));

What's happening here?

• This whole /api/signup route is YOUR OWN API. You built it from scratch.
• You had to think about password security, database structure, tokens — everything.
• This works fine, but it takes a lot of time and knowledge to do correctly and safely.

This is what it means to build a backend manually, calling low-level tools directly.

---

4. Real Example: Same Sign Up Feature Using Supabase (SDK)

Now let's do the exact same thing using Supabase, which is a backend-as-a-service platform.

Supabase already has:

• A database (PostgreSQL) ready for you
• A complete authentication system (sign up, login, password reset)
• A JavaScript SDK that wraps their APIs into simple functions

First, install their SDK:

npm install @supabase/supabase-js

Then connect to your Supabase project:

// supabaseClient.js

import { createClient } from '@supabase/supabase-js'

const supabaseUrl = 'https://your-project.supabase.co'
const supabaseKey = 'your-public-anon-key'

export const supabase = createClient(supabaseUrl, supabaseKey)

Now here is the ENTIRE sign-up feature:

// signup.js

import { supabase } from './supabaseClient'

async function signUpUser(email, password) {
  const { data, error } = await supabase.auth.signUp({
    email: email,
    password: password
  })

  if (error) {
    console.log("Error:", error.message)
    return
  }

  console.log("User created:", data.user)
}

signUpUser("[e-mail]", "12345678")

That's it. Just a few lines.

What just happened?

• No password hashing code written by you (Supabase's backend does it).
• No database table setup for users needed (Supabase manages it).
• No JWT token code written by you (Supabase creates and manages tokens).
• You just called supabase.auth.signUp() — one simple SDK function.

---

5. So Where is the "API" in Supabase?

Here is the important part that connects everything together.

Even though you wrote supabase.auth.signUp(...), behind the scenes, the Supabase SDK is actually calling a real API for you. It's happening automatically, hidden from your eyes.

If you check your browser's network tab, you would actually see something like this happening automatically:

POST https://your-project.supabase.co/auth/v1/signup
Body: { "email": "[e-mail]", "password": "12345678" }

This is the real API request. The SDK just wrote this request FOR you.

So the relationship is:

Your Code  →  SDK function (supabase.auth.signUp)  →  API request (POST /auth/v1/signup)  →  Supabase's Server

---

6. Side-by-Side Comparison Table

Feature	Manual Backend (Raw API)	Supabase (SDK)
Writing the server	You build it yourself	Already built for you
Database setup	You design tables, connect DB	Ready-made, just configure
Password security	You write hashing code	Handled automatically
Auth tokens (JWT)	You create and manage	Handled automatically
Code needed for sign up	~20-30 lines	~5 lines
Speed of development	Slow	Fast
Control over every detail	Full control	Less control, more convenience
What you're really using	Raw HTTP requests	Helper functions that call APIs internally

---

7. The Simplest Way to Remember This

• API = the actual communication rule / request that goes from one app to another (like a raw letter you send).
• SDK = a toolbox of ready-made functions that write and send that letter FOR you, so you don't have to write it by hand every time.

Every SDK uses an API internally. But not every API has an SDK.

Some APIs are "raw" — you must call them yourself using fetch() or similar tools (like our manual Express.js backend). Other services, like Supabase, Stripe, Firebase, and Twilio, give you an SDK so that using their API becomes much simpler and safer.

---

8. Final Thought

If you are learning backend development:

• Building things manually first (like we did with Express.js) is a GREAT way to learn how things really work underneath.
• Using SDKs (like Supabase) later is great for building real products faster, because you don't need to reinvent authentication, databases, and security every single time.

Both are useful skills. Understanding both means you truly understand how modern backend development works — from the ground up, and from the "easy tools" side too.