NFTs are tokens. When you query token balances from these API's, you are getting a mixture of Fungible and non-Fungible tokens back. Users can have more than 1 of the same NFT, so they also have a balance (think of a trading card game where you can get duplicates). I'm not aware of any API that returns a dedicated list of NFTs versus fungible tokens.
In terms of code/standards. The standard that enabled NFTs is called "Fa2". This added an extra property to the token standard called "TokenID". Non-fungible tokens use a combination of token contract address + tokenID to differentiate each individual NFT.
As an example, look at Pixel potus. Each NFT uses the same token address
KT1abc123 but each type of NFT has a unique token ID
Address: `KT1abc123` + TokenID: `1000` = common George Washington
Address: `KT1abc123` + TokenID: `1001` = common John Adams
Address: `KT1abc123` + TokenID: `2000` = uncommon George Washington
Address: `KT1abc123` + TokenID: `2001` = uncommon John Adams
... and so on
I have seen at least one company use a combination of address + unique token ID to create multiple fungible tokens "grouped" together. So a non-zero ID doesn't necessarily correspond to an NFT either
To the best of my knowledge there is no sure fire way to detect an NFT, as there is nothing in the standard to say the metadata must include
NFT: true. There really should be such a thing, but there isn't.
As a rough example, if you get a list of tokens the user owns from BCD / TzKT, query the metadata for each one and then check something like:
return standard == "fa2" && decimals == 0 && artifactUri != null
You will get at least some good results, but i've not tested it against a wide variety of NFT's / tokens. To the best of my knowledge, no NFT has decimals, must be the FA2 standard and should contain a link to some artifact/asset for which the NFT is linked too.
Others suggest using API's to get a list of tokens from dex's like Quipuswap and simply say if the token doesn't appear on this list, theres a high probability its an NFT. This also has issues, as more dApps are being created, people are using other means to launch their tokens other than dexs, resulting in a lot of false positives.