API Security Best Practices
Authentication, object authorization, input validation, webhooks, abuse controls, and logging for production APIs.
Read guideArcjet Learning Center
Web Security Guides
Application-layer guidance for securing APIs, stopping automated abuse, and controlling resource consumption.
What these guides cover
Web security protects application entry points, APIs, identities, data, and constrained resources from unauthorized access and abuse. Valid syntax is not proof of a safe request: an authenticated caller can target another tenant's object, a bot can automate a legitimate checkout flow, and a distributed client can exhaust an expensive operation without crossing a simple per-IP threshold. Effective protection combines strict authentication and object-level authorization with input validation, resource-aware limits, automation detection, observable decisions, and controls close to the application logic that understands the requested operation and its business impact. Controls should degrade predictably when shared security dependencies are slow or unavailable.
Risks
- Broken object and function-level authorization
- Malicious input and unsafe downstream requests
- Credential stuffing, scraping, spam, and fraud
- Resource exhaustion and distributed automation
Control priorities
- Strong identity and authorization for every object and action
- Schema validation and constrained downstream behavior
- Identity-aware rate limits and bot detection
- Security telemetry, dry-run rollout, and incident response
Recommended reading order
Begin with API security best practices for the complete control baseline. Read the API abuse guide to understand valid-looking malicious automation, then use the rate limiting guide to select algorithms, identifiers, and failure behavior for resource controls. Use the application and framework checklists for stack-specific controls, and the secrets guides when the risk is credential or PII leakage.
Guides in this collection
How enterprises secure APIs against abuse and bots
Identity-aware rate limits and bot detection on the routes that matter — not only a perimeter WAF.
Read guideAI agent bot management
Detect, classify, and apply policy to AI agents that hit logins, checkouts, scrapers, and APIs.
Read guideWhat Is API Abuse? How Bots Exploit APIs
API abuse is the automated or malicious use of valid API functionality in ways that create fraud, cost, disruption, or data loss.
Read guideRate-limiting algorithms compared: token bucket, leaky bucket, sliding window, and fixed window
Token bucket, leaky bucket, sliding window, or fixed window?
Read guideWhat Is Runtime Application Security?
Runtime application security enforces controls in the path of the action, using the application's own context.
Read guideSDK-based security vs WAF vs API gateway
What each layer sees, and why teams add bots, rate limits, and attack blocking in application code instead of only at the edge.
Read guideHow to Enforce Security Rules at Runtime in Your Code
The rule ships with the feature and runs in the request path.
Read guideHow do I detect and block attacks at runtime?
Detect injection, abuse, exfiltration, and agent manipulation in the handler, then deny before the query, the charge, or the model.
Read guideHow to identify AI agents and bots
Treat User-Agent as a claim, then verify with reverse DNS, public IP ranges, and application context.
Read guideBot detection techniques for developers
Bot detection is classifying automated HTTP clients and enforcing a policy: allow a verified crawler, constrain a script, or deny abuse.
Read guideIs CAPTCHA still effective, and what should you use instead?
CAPTCHA is no longer an effective primary control.
Read guideWhat is bot spoofing and how do you detect it?
Bot spoofing is a client claiming to be a known, usually trusted, automated agent while actually being someone else.
Read guideHow do you detect bots at the application layer?
Detect bots where route, user, and business context reveal scraping, credential stuffing, and abuse.
Read guideHow to protect a React Hook Form from spam
Protect a React Hook Form by combining client and server validation, rate limiting, bot detection, and email verification.
Read guideHow do you secure a Node.js/Express API?
Secure a Node.js/Express API by calling Arcjet protect() in middleware before the route runs.
How do you secure a GraphQL API?
GraphQL security is more than an HTTP rate limit: one request can batch, alias, or nest enough work to exhaust the process.
Read guideHow do you add rate limits and bot detection to a GraphQL API?
Token-bucket rate limits and bot detection on Yoga and Next.js, plus SHA-256 persisted operations.
Read guideHow do you secure serverless and edge apps?
Serverless and edge apps expose many independently invocable functions, so a perimeter WAF is not enough.
Read guideAre Next.js server actions a security risk?
Are Next.js server actions a security risk?
Read guideWere you affected by the Next.js middleware bypasses?
Were you affected by the Next.js middleware bypasses?
Read guideHow do you prevent SQL injection and XSS in Node.js?
SQL injection is untrusted input that becomes SQL syntax.
Read guideDoes Next.js need a WAF?
Does Next.js need a WAF? Yes, for scanners, known CVEs, and PCI DSS 4.0. Prefer an in-app Shield rule you can dry-run behind.
Read guideWhat is permissions-based security in Next.js?
Authentication names the user, Permit.io decides whether that identity may act on an object, and Arcjet stops attacks and abuse on the request.
Read guideHow to differentiate DoS attacks from legitimate traffic
Tell a denial-of-service flood from a large customer by identity, not volume.
Read guideHow to add rate limiting to SvelteKit form actions
Rate limiting controls how many actions an identity can perform in a period.
Read guideDynamic rate limiting with feature flags
Change Arcjet rate limits at runtime without redeploying.
Read guideNext.js security checklist
Seven-item App Router checklist: dependencies, validation, secrets, server-only code, headers, centralized checks, and CI scanning.
Read guideRemix security checklist
Remix v2 and React Router 7: module side effects, signed cookies, CSRF, headers, validation, and uploads.
Read guideWeb app security checklist
A practical web app checklist: auth, input validation, secrets, headers, dependency risk, and in-app controls.
Read guideHow to secure login pages
Plan for four threats: brute force, credential stuffing, SQL injection, and session theft.
Read guideSecurity advice for self-hosting Next.js in Docker
Pin node:22-bookworm for builds and node:22-bookworm-slim or gcr.io/distroless/nodejs22-debian13:nonroot for the runner.
How to secure your NestJS application with Arcjet
Secure NestJS 10 and 11 with @arcjet/nest v1.
Read guideStructured logging in JSON for Next.js
Add structured JSON logging to Next.js 15 with Pino via the Instrumentation hook or next-logger v5.
Read guideProtecting self-hosted Coolify apps
Install Tailscale first, deny inbound except tailscale0, then install Coolify on the tailnet.
How do I deploy an Arcjet-protected app to Fly.io?
Deploy Arcjet on Fly.io with v1 config, Fly-Client-IP detection, rate limiting, and bot protection.
Read guideHow do I secure a container deployment?
Secure Node.js containers with a non-root USER, Node 22 on current Debian, Distroless or Wolfi bases, a read-only root, secret scanning, and.
Read guideWhy do TLS certificates fail in slim Node.js containers on OrbStack?
Node.js trusts a frozen Mozilla CA snapshot, not OrbStack's local CA.
Read guideHow do I detect the client IP on Firebase?
Get the real client IP on Firebase from x-fah-client-ip after FIREBASE_CONFIG platform detection.
Read guideWhy do NEXT_PUBLIC_ variables leak into the Next.js client bundle?
NEXT_PUBLIC_ env vars are inlined into the browser bundle.
Read guideHow do I test Next.js App Router API routes?
Test Next.js API routes for auth gaps, abuse paths, and Arcjet decisions without flaky end-to-end suites.
Read guideHow do I functionally test security rules?
Test live Arcjet rules with Newman or k6 against the same binary you deploy.
Read guideWhat is a race condition attack?
Force two requests through the same check-then-act window so a one-time coupon or token is used twice.
Read guideWhat is a dependency confusion attack?
A public package that shares an internal name installs instead — reserve your npm scope and pin it in .npmrc.
Read guideWhat is a trivial package?
A trivial package is a short dependency you could write yourself. Prefer natives such as padStart over tiny npm helpers.
Read guideWhat is package hijacking?
When someone else can publish a package you trust, or serve a replacement at a URL you pin — accounts, domains, Polyfill.io.
Read guideWhat is secrets exfiltration?
Credentials leave via repos, CI logs, container layers, or deleted forks — detect, rotate, and close the path.
Read guideShould you store secrets in environment variables?
Production secrets in env vars are plaintext with no audit trail. Store an ID and fetch at runtime instead.
Read guideHow do you redact sensitive data from Go logs?
Implement slog.LogValuer on types that hold secrets so only allow-listed fields are logged.
Read guidePII detection for production AI applications
Production PII detection: placement, latency budgets, fail-open versus fail-closed, staged rollout, and review questions.
Read guide