What is the difference between HTTP and HTTPS?

HTTP (HyperText Transfer Protocol) transmits data in plain text, making it vulnerable to man-in-the-middle attacks where anyone on the network path can read or modify the data. HTTPS (HTTP Secure) wraps HTTP inside a TLS (Transport Layer Security) layer that encrypts all data in transit, authenticates the server's identity via a digital certificate, and ensures data integrity. All production REST APIs must use HTTPS. Sending API keys or JWT tokens over plain HTTP exposes them to interception. Modern browsers and HTTP clients warn against or block mixed-content HTTP requests. Certificate management is handled by services like Let's Encrypt (free) or commercial CAs, and cloud providers like AWS, Azure, and GCP include managed TLS termination.