API Development Cost in India: The Short Answer
In 2026, a simple internal API costs Rs. 1,20,000 to Rs. 3,50,000. A partner facing API costs Rs. 3,50,000 to Rs. 8,00,000. A public API with developer onboarding starts near Rs. 8,00,000 and reaches Rs. 18,00,000 once a sandbox, documentation and a support desk are included.
The spread is wide because “build me an API” covers two different jobs. One is exposing data you own to a system you also own. The other is publishing a contract that other companies build their products on, which you then cannot break for years without breaking their businesses. The second job is not twice the work. It is closer to five times, and most of the extra cost sits outside the code.
What Actually Moves the Price
Six variables explain almost the whole gap between a Rs. 1,50,000 quote and a Rs. 9,00,000 quote for the same brief. Get them answered in writing before you compare vendors. A quote written against a vague brief is a guess wearing a number.
Number of endpoints, and how different they are
Counting endpoints is crude and still the first thing to pin down. Twelve endpoints reading and writing across the same three tables are cheap, roughly Rs. 8,000 to Rs. 18,000 each once the project skeleton exists. Twelve endpoints that each touch a different subsystem, with their own validation rules and failure modes, are not. Ask a vendor to price per endpoint group rather than per endpoint, then ask what the thirteenth costs.
The authentication model you choose
A static API key checked on every request is about a day of work. Signed keys with rotation and per client secrets add a few days. Full OAuth 2.0, with refresh tokens, scopes per partner and a consent screen, is a two to four week module, usually Rs. 90,000 to Rs. 2,50,000 depending on grant types. Do not buy OAuth because it sounds enterprise. Buy it when a third party acts on behalf of your users and you need to revoke one partner without resetting anyone’s password.
Data volume, and real time versus batch
An API serving a few thousand calls a day can share a server with your main application. One serving a few million needs connection pooling, caching, pagination that survives load, and a database indexed for the queries the API creates, not the ones your admin panel creates. Real time is the expensive phrase in any brief. Webhooks and event streams mean you own delivery guarantees, retries, dead letter handling and idempotency, so a partner receiving the same event twice does not bill a customer twice. Batch means a file lands at 2 am and a failure gives you until morning. The same outcome as a nightly batch is routinely half the price.
Third party systems, and whether the other side is documented
Integrating with a documented platform that offers a sandbox is predictable work. Integrating with a fifteen year old ERP, a distributor’s portal or a bank file exchange, where the only documentation is a PDF from 2019 and one engineer’s memory, is not. Honest vendors handle this as a paid discovery phase of Rs. 40,000 to Rs. 1,00,000 and fix the price only after it ends. A vendor who fixes a price on an undocumented system before touching it is either padding heavily or planning to recover the gap through change requests.
Cost Bands for the Three Kinds of API
These bands assume production quality: input validation, structured error responses, logging, tests on the critical paths and a repeatable deployment. They do not describe a prototype you intend to throw away.
| API type | What it includes | Typical cost | Timeline |
|---|---|---|---|
| Simple internal API | 8 to 15 endpoints, one consumer you control, key based auth | Rs. 1,20,000 to Rs. 3,50,000 | 4 to 8 weeks |
| Integration layer | Adapters, field mapping, retries and reconciliation for two to four systems | Rs. 2,50,000 to Rs. 6,50,000 | 6 to 12 weeks |
| Partner facing API | 15 to 30 endpoints, per partner credentials, rate limits, sandbox, docs | Rs. 3,50,000 to Rs. 8,00,000 | 8 to 14 weeks |
| Public API with onboarding | Self serve signup, OAuth, docs portal, versioning policy, status page | Rs. 8,00,000 to Rs. 18,00,000 | 4 to 7 months |
Most businesses belong in the first three rows. The public API band is a product decision, not a technical one, and whoever owns revenue should sign it off, because you are committing to support strangers for years. If the API is one part of a larger build, read it against the cost structure of a full custom web application, where the API is usually 25 to 40 percent of the total.
The Parts Buyers Do Not Price In
Every overrun we see on API projects comes from the same short list. All of it is invisible in a demo, which is why it gets cut during negotiation and rebuilt at full price six months later.
Documentation and a sandbox environment
Reference documentation for a 20 endpoint API is about a week of real work: request and response examples, every error code with its meaning, an authentication walkthrough and a changelog. Budget Rs. 40,000 to Rs. 90,000. A sandbox, a separate environment with seeded test data where a partner can break things safely, adds Rs. 50,000 to Rs. 1,50,000 because it needs its own deployment, data reset routine and credentials. Without one, every partner test happens on your production database, which is how test orders reach real dispatch queues.
Versioning, rate limiting, monitoring and alerting
A versioning strategy costs nothing to decide on day one and a fortune to retrofit. Decide whether the version lives in the URL or a header, how long an old version stays supported, and how a breaking change is announced. Rate limiting stops one partner’s runaway loop from eating the capacity everyone else paid for, and it needs per client quotas, not one global limit. Monitoring means uptime checks, error rate alerts and latency tracking that page a human. Together these add Rs. 60,000 to Rs. 2,00,000. The alternative is your partner telling you the API is down, the most expensive way to find out.
Why an Undocumented API Costs More Over Three Years
The mechanism is worth spelling out to whoever controls the budget. An undocumented API moves its knowledge into people. Every partner integration then needs a call with your developer. Every new hire spends two weeks reading code to answer what the docs should have answered in ten seconds. Every support ticket becomes a debugging session, because nobody can say what the correct behaviour is.
Now compound it. With five partners each raising one question a month, an undocumented API burns several developer hours a week, spent by your most expensive people, producing nothing new. The same gap makes change dangerous: nobody knows who depends on which field, so nothing is ever removed and dead fields must be maintained forever. The documented version costs about Rs. 60,000 more at build time and stays cheap to change. The undocumented one is cheaper on the invoice and slowly freezes.
Security Essentials You Should Insist On
An API is a door into your database that you deliberately leave unlocked for the right people. Three things separate a professional build from a dangerous one.
Keys versus OAuth, and where the line sits
Use API keys when the caller is a server you or your partner controls and one key equals one organisation. Use OAuth when the caller acts for an individual user, when you need scopes so a partner can read orders but not refund them, or when consent must be revocable per user. What you must never accept is a key embedded in a mobile app or in browser JavaScript, because anyone can read it out in a minute. If an app needs data, it should call your own backend, which holds the key. It is a common audit finding and cheap to fix before launch.
Server side validation and audit logging
Client side validation is a user experience feature. It is not security and never was. Every field arriving at your API must be validated on the server for type, range, length and permission, because an attacker does not use your form, they use a command line. The permission check matters most: if partner A can fetch partner B’s order by changing one number in the URL, you have the most common real world breach in Indian software, and it will be found. Insist on an audit log recording who called what, with which credential, from which address and when, kept for at least a year. It is the difference between a two hour investigation and a two week one.
What a Delivery Must Include Before You Sign It Off
Do not accept “the API is ready” as a delivery. Accept the list below instead. Every item can be checked by a non technical buyer in a few minutes, which is the point of writing acceptance criteria.
| Deliverable | Why it matters | How to verify it |
|---|---|---|
| Reference docs with examples | Removes the vendor from future questions | An outside developer makes one call unaided |
| Sandbox with test credentials | Partners integrate without touching live data | Confirm it has its own database and resets |
| Error catalogue | Tickets answered without a developer | Each code has a plain English cause and fix |
| Repository in your own account | You keep the asset if the vendor vanishes | Log in and confirm you are owner, not member |
| Deployment runbook | Another team can take over in a week | A second developer deploys from it alone |
| Monitoring and alert routing | You hear about downtime before your partner | Ask for a test alert on your phone |
GST, Payment Terms and What the Invoice Should Say
API development is a service and attracts GST at 18 percent, so a Rs. 4,00,000 project invoices at Rs. 4,72,000. If your business is GST registered, that 18 percent is usually available as input tax credit, which is why a registered vendor is often cheaper in practice than a freelancer quoting a lower number without a tax invoice. Check the GSTIN before the first payment and confirm the invoice carries the correct SAC code and your own GSTIN, because a mismatch blocks the credit. The same rules run across every software service you buy, covered in our note on GST on software services.
On payment structure, refuse a single upfront payment and refuse a single payment at the end. Milestone billing protects both sides: 25 percent to start, 25 percent when authentication and the first endpoint group work in a sandbox, 25 percent at feature complete, 25 percent after acceptance testing. Tie each milestone to something you can check, never to a date. Agree the change request rate in the contract as a published hourly or per endpoint figure, so a mid project addition is a known number rather than a negotiation you enter with no leverage.
Get a Fixed Scope and a Real Number
Tell us what your systems need to exchange and we will send back an endpoint list, an authentication recommendation and a milestone quote you can compare against any vendor in India.
Who Owns the Code, the Repository and the Keys
Write into the contract that all source code, database schema, documentation and deployment scripts become your property on final payment, with a full assignment of intellectual property. That clause is standard and its absence is deliberate. Then go past the contract, because ownership on paper means nothing if you cannot reach the asset. The repository must live in an organisation account created with your company email, with your own account as owner and the vendor added as a member. Hosting and third party service accounts follow the same rule.
Ask one more question before signing: what happens if you disappear. The honest answer is a named handover package, a runbook and a support window of 30 to 90 days after go live at no extra cost. A vendor who keeps the repository in their own account and hands you a zip file at the end is selling a dependency, not software.
When You Should NOT Build an API
This is the section most vendors leave out, so here it is plainly. A custom API is the wrong purchase in three common situations.
First, when the exchange is simple and not time sensitive. If head office needs yesterday’s sales from four branches, a scheduled export writing a file to shared storage, plus a scheduled import at the other end, costs Rs. 25,000 to Rs. 70,000 and runs for years with almost no maintenance. No authentication surface, no uptime obligation, no support burden. Buyers reject it because it sounds unsophisticated. It is simply the correct size of solution.
Second, when an integration platform already connects both ends. If you are moving data between mainstream cloud tools that both ship connectors, a subscription platform solves it in days. Custom code earns its cost when volume makes per operation pricing painful, when the logic is too complex to stay readable in a visual builder, or when no connector exists for your internal system. A platform at Rs. 6,000 a month is Rs. 2,16,000 over three years, real money and still less than a mid sized custom build plus maintenance.
Third, when you do not yet know which data other people want. Building a public API before a single partner has asked for one is the most expensive way to learn that nobody needed it. Build the internal API you need now, keep the design clean enough to expose later, and let the second real partner request pay for the public version.
How to Compare Three API Quotes Without Getting Fooled
Send every vendor the same one page brief: the systems involved, what data moves, in which direction, how often, and what happens when it fails. Then compare on three things. Is the endpoint list written down, or is it “as discussed”? Are documentation, sandbox, monitoring and handover priced as line items, or missing? Is there a named support period after go live with a response time in hours?
The cheapest quote usually wins by removing exactly those items, so you have not saved money, you have deferred it and added risk. Pick the one whose assumptions you can read. Our team works from Pune and builds APIs and integrations for clients across India, and the strongest predictor of a smooth project is simple: the buyer who insisted on a written endpoint list before signing almost never ends up in a dispute.
Also read: if you are scoping a wider build, compare our breakdown of website maintenance cost in India, the options for payment gateways in India, and how we approach custom software projects end to end.
