APIs are the attack surface of the modern web. These security practices are not optional — they are the minimum bar for any API handling real user data.
The API Attack Surface Is Bigger Than You Think
APIs now account for 83% of all web traffic, according to Akamai's latest State of the Internet report. They are also the primary target for data breaches. The OWASP API Security Top 10 reads like a chronicle of real attacks against real companies — Peloton, LinkedIn, T-Mobile, and dozens of others suffered API-related breaches that exposed millions of records. These attacks are not sophisticated zero-days. Most exploit basic security failures that are entirely preventable.
Authentication: Getting Identity Right
OAuth 2.0 + OIDC for Delegated Access
Never roll your own authentication. Use OAuth 2.0 with the PKCE extension for user-facing applications and client credentials flow for service-to-service communication. OpenID Connect adds identity on top of OAuth 2.0. Libraries implementing these standards correctly exist for every language — use them.
JWT Security
JWTs are often misimplemented. Critical rules: always validate the signature (never trust an unverified token), verify the algorithm claim (the "alg: none" attack is embarrassingly simple), set short expiration times (15–60 minutes for access tokens), use refresh token rotation, and store tokens in httpOnly cookies rather than localStorage to prevent XSS theft.
API Keys
For M2M communication, scoped API keys with least-privilege permissions are often simpler than OAuth flows. Hash keys before storing (a breached database should not expose functional keys). Implement key rotation. Never embed API keys in client-side code or version control — use environment variables and secret management systems.
Authorisation: Who Can Do What
Authentication establishes identity. Authorisation determines what that identity can access. Broken Object Level Authorisation (BOLA) — where user A can access user B's data by guessing or modifying an ID — is the most common API vulnerability. Every data access must verify that the authenticated user has permission to access that specific resource.
Implement authorisation at the service layer, not just the API gateway. The gateway can handle coarse-grained access control; fine-grained checks must happen close to the data. Open Policy Agent (OPA) provides a powerful, auditable authorisation policy engine that decouples policy from application code.
Input Validation and Injection Prevention
Validate every input against a schema before processing. Define allowlists, not blocklists — specify what is allowed rather than what is forbidden. Use parameterised queries without exception; never concatenate user input into SQL strings. Validate content types; reject requests with unexpected Content-Type headers.
For JSON APIs, define and enforce a JSON Schema for every request body. A 400 Bad Request with a meaningful error message is vastly preferable to a 500 Internal Server Error from an unexpected input reaching your database.
Rate Limiting and Abuse Prevention
Apply rate limits at multiple levels: per IP, per user, per API key, and per endpoint. Credential stuffing attacks typically involve millions of login attempts — without rate limiting, a single attacker can iterate through your entire user base. Implement exponential backoff for repeated failures. Use 429 Too Many Requests with Retry-After headers to communicate limits to legitimate clients.
Transport Security
TLS 1.3 everywhere. HSTS with a long max-age and includeSubDomains. Certificate pinning for mobile clients accessing critical APIs. Disable weak cipher suites. Run your API through SSL Labs to score your TLS configuration.
Logging and Monitoring
Log every API request with: timestamp, endpoint, method, response code, authenticated user (if any), IP address, and response time. Do not log request bodies that may contain PII or credentials. Alert on: unusual error rate spikes, authentication failure surges, abnormal data access volumes (a user downloading 10,000 records is an anomaly), and requests from new geographic locations for privileged accounts.
The Security Development Lifecycle
Security is not a final step before deployment. Include threat modelling in design, security review in code review, DAST scanning in CI/CD pipelines, and penetration testing before major releases. The cost of finding a vulnerability in design is 100× cheaper than finding it in production.
Expert insights on AI, software engineering, and digital transformation from the TechGeneses team of engineers and strategists.