API Security Essentials
Defence in depth for APIs: transport, identity, authorization, input and abuse controls.
APIs expose business logic and data directly, which makes them a prime target. Security comes from layers, so that if one control fails another still protects the data.
The most common real-world API breach is not exotic cryptography — it is broken authorization: a user changing an ID in the URL and getting someone else’s record.
Diagram
Key concepts
- HTTPS everywhere
- Encrypt in transit, enable HSTS, never send tokens over plain HTTP.
- Authentication
- Verify identity with OAuth 2.0 / OpenID Connect, short-lived tokens and MFA for users.
- Object-level authorization
- On every request, check the caller may access this specific record — not just that they are logged in.
- Input validation
- Validate type, length and format; use parameterised queries to prevent injection.
- Rate limiting
- Throttle by client to stop brute force and scraping.
- Least privilege
- Tokens, service accounts and database users get only the permissions they need.
- Secrets management
- Keep keys in a vault (Key Vault, Secrets Manager), never in code or logs.
Trade-offs
Benefits
- Layered controls limit the blast radius of any one bug
- Central policies at the gateway plus checks in each service
Costs
- Every layer adds latency and operational work
- Security misconfiguration is easy without automation and reviews
Use it when
- Always — every API, internal ones included
Common mistakes
- Trusting IDs from the client without checking ownership (IDOR / BOLA)
- Returning stack traces or internal errors to callers
- Logging tokens, passwords or personal data
- CORS set to
*with credentials
Interview questions
Q1What is BOLA / IDOR?
Broken object-level authorization:
GET /invoices/1043 returns invoice 1043 even when it belongs to another customer. Fix it by checking ownership or tenant on every data access.Q2Why use short-lived access tokens with refresh tokens?
A stolen access token is only useful for minutes. Refresh tokens can be rotated, bound to the client and revoked centrally.
Q3Is a WAF enough to secure an API?
No. A WAF blocks known bad patterns, but it cannot know your business rules. Authorization and validation must live in the application.
Related lessons
APIs & Security
API Authentication Methods
Basic auth, API keys, sessions, JWT bearer tokens and OAuth 2.0 compared.
APIs & SecuritySingle Sign-On (SSO)
Sign in once with a central identity provider and access many applications.
Scalability & PerformanceRate Limiting
Cap how many requests a client can make so one caller can’t overwhelm everyone else.