What does it mean for a REST API to be stateless?
Understand what a stateless REST API means, why servers keep no session, how tokens carry context, and how statelessness enables scaling — with clear examples.
Expected Interview Answer
A stateless REST API means the server keeps no client session context between requests — each request must carry all the information (authentication, parameters, body) the server needs to understand and process it on its own.
Because the server stores nothing about previous interactions, any server instance can handle any request, which makes horizontal scaling and load balancing straightforward. Client-specific state, such as who is logged in, travels with every request, typically as a token in the Authorization header. Application state that must persist (like an order) is stored as a resource in a database, not as an in-memory session tied to one server.
- Easy horizontal scaling across many servers
- Any instance can serve any request
- Simpler failure recovery with no lost sessions
- Better cacheability of responses
- Reduced server memory footprint
AI Mentor Explanation
Statelessness is like a substitute umpire who can walk in for any over and rule correctly because every delivery is judged purely on what happens in front of them, not on remembered earlier balls. No handover briefing is needed. A stateless API works identically: each request is self-contained, so any server can step in and decide it without prior session memory.
Step-by-Step Explanation
Step 1
Put identity in the request
Send credentials such as a bearer token in the Authorization header on every call rather than a server session.
Step 2
Include all needed context
Add query parameters, path IDs, and body payloads so the request is fully self-describing.
Step 3
Store persistent data as resources
Keep durable application state (orders, carts) in a shared database, not in one server's memory.
Step 4
Avoid sticky sessions
Design so any server instance can handle any request, enabling round-robin load balancing.
Step 5
Leverage caching and tokens
Use stateless tokens (like JWT) and cacheable responses to keep the interaction memory-free and fast.
What Interviewer Expects
- Definition of statelessness in REST
- Where client and application state actually live
- Connection between statelessness and scalability
- Use of tokens instead of server sessions
- Awareness of trade-offs like larger requests
Common Mistakes
- Confusing stateless with having no data at all
- Relying on in-memory server sessions and sticky load balancing
- Thinking statelessness forbids databases
- Ignoring that credentials must be sent each request
- Overlooking the payload overhead of stateless tokens
Best Answer (HR Friendly)
“Stateless means the server does not remember anything about you between requests, so every request has to include everything needed to handle it. This makes the system easier to scale because any server can answer any request without shared memory.”
Code Example
GET /api/orders HTTP/1.1
Host: example.com
Authorization: Bearer eyJhbGciOiJIUzI1NiIs...
Accept: application/json
HTTP/1.1 200 OK
Content-Type: application/json
[ { "id": 1001, "status": "shipped" } ]Follow-up Questions
- How do JWTs enable stateless authentication?
- What are the downsides of statelessness?
- How does statelessness help horizontal scaling?
- Where should session-like data live in a stateless API?
- What is a sticky session and why avoid it?
MCQ Practice
1. In a stateless REST API, where is client authentication typically carried?
Statelessness requires each request to carry its own credentials, commonly a bearer token in the Authorization header.
2. A key benefit of statelessness is:
Because no server holds session state, any instance can serve any request, making horizontal scaling and load balancing simple.
3. Which statement about statelessness is correct?
Stateless means each request is self-contained; durable data still lives in databases, and any server can handle it.
Flash Cards
What is a stateless API? — One where the server keeps no client session between requests; each request carries all needed context.
Where does identity live? — In the request itself, typically a token in the Authorization header, not a server session.
Why is statelessness scalable? — Any server instance can handle any request, so load balancing and horizontal scaling are trivial.
Stateless vs no data? — Stateless refers to session memory only; persistent data still lives in a shared database as resources.