diff --git a/src/hooks.ts b/src/hooks.ts
index d767555..6e31b7a 100644
--- a/src/hooks.ts
+++ b/src/hooks.ts
@@ -10,7 +10,7 @@ export const handle: Handle = async ({ event, resolve }) => {
 
 	if (!cookies.userid) {
 		// if this is the first time the user has visited this app,
-		// set a cookie so that we recognise them when they return
+		// set a cookie so that we recognize them when they return
 		response.headers.set(
 			'set-cookie',
 			cookie.serialize('userid', event.locals.userid, {
diff --git a/src/routes/_api.ts b/src/routes/_api.ts
new file mode 100644
index 0000000..dcc5b3d
--- /dev/null
+++ b/src/routes/_api.ts
@@ -0,0 +1,27 @@
+/*
+  This module is used by the /todos endpoint to
+  make calls to api.svelte.dev, which stores todos
+  for each user. The leading underscore indicates that this is
+  a private module, _not_ an endpoint — visiting /todos/_api
+  will net you a 404 response.
+
+  (The data on the todo app will expire periodically; no
+  guarantees are made. Don't use it to organize your life.)
+*/
+
+import { URLSearchParams } from "url";
+
+const base = 'https://api.boardgameatlas.com/api';
+
+export function api(method: string, resource: string, queryParams: Record<string, string>, data?: Record<string, unknown>) {
+  queryParams.client_key = import.meta.env.BASE_URL
+  const urlQueryParams = new URLSearchParams(queryParams)
+  const url = `${base}/${resource}${urlQueryParams ? urlQueryParams : ''}`
+  return fetch(url, {
+    method,
+    headers: {
+      'content-type': 'application/json'
+    },
+    body: data && JSON.stringify(data)
+  });
+}