For questions related to IOTA's Application Programming Interface (API)
The IOTA Java client makes it possible to interact with your local node and request certain information or actions to be taken. Once your node is set up, you can interface with it through port 14265 by passing along a JSON object which contains a specified command; and upon successful execution of the command, returns your requested information.
The main priority of the API is security. As such, anything that has to do with private keys is done client side. There are several libraries that take care of security.