When you interact with CircleCI's web application, all of your requests are hitting the #API hosts. We handle the majority of our authentication via #OAuth from GitHub or Bitbucket. We provide programmatic access to everything exposed in the UI through an API token that you can generate once you have authenticated.