API Security Best Practices
API security best practices for authentication, object authorization, input validation, webhooks, abuse controls, monitoring, and continuous testing.
Read guideArcjet Learning Center
Web Security Guides
Application-layer guidance for securing APIs, stopping automated abuse, and controlling resource consumption.
What these guides cover
Web security protects application entry points, APIs, identities, data, and constrained resources from unauthorized access and abuse. Valid syntax is not proof of a safe request: an authenticated caller can target another tenant's object, a bot can automate a legitimate checkout flow, and a distributed client can exhaust an expensive operation without crossing a simple per-IP threshold. Effective protection combines strict authentication and object-level authorization with input validation, resource-aware limits, automation detection, observable decisions, and controls close to the application logic that understands the requested operation and its business impact. Controls should degrade predictably when shared security dependencies are slow or unavailable.
Risks
- Broken object and function-level authorization
- Malicious input and unsafe downstream requests
- Credential stuffing, scraping, spam, and fraud
- Resource exhaustion and distributed automation
Control priorities
- Strong identity and authorization for every object and action
- Schema validation and constrained downstream behavior
- Identity-aware rate limits and bot detection
- Security telemetry, dry-run rollout, and incident response
Recommended reading order
Begin with API security best practices for the complete control baseline. Read the API abuse guide to understand valid-looking malicious automation, then use the rate limiting guide to select algorithms, identifiers, and failure behavior for resource controls. Use the application and framework checklists for stack-specific controls, and the secrets guides when the risk is credential or PII leakage.
Guides in this collection
How enterprises secure APIs against abuse and bots
How enterprises secure APIs against abuse and bots: identity-aware rate limits and bot detection on the operation, plus an honest split between edge platforms and in-app SDKs.
Read guideAI agent bot management
AI agent bot management detects, classifies, and applies policy to AI agents that hit your logins, checkouts, forms, and APIs as clients, not the agents your engineers run.
Read guideWhat Is API Abuse? How Bots Exploit APIs
API abuse explained: how bots automate valid operations for fraud, scraping, account takeover, and cost exhaustion, and how application controls stop them.
Read guideRate-limiting algorithms compared: token bucket, leaky bucket, sliding window, and fixed window
Token bucket, leaky bucket, sliding window, or fixed window? This guide explains how each rate-limiting algorithm works and when to use it in your API.
Read guideWhat Is Runtime Application Security?
Runtime application security enforces controls while the application runs, at the point untrusted input meets your code, with context that pre- and post-runtime tools do not have.
Read guideSDK-based security vs WAF vs API gateway
SDK-based security vs WAF vs API gateway: what each layer sees, why indie teams import a library instead of pointing DNS at Cloudflare, and how to add bots, rate limits, and attack blocking in a few lines of code.
Read guideHow to Enforce Security Rules at Runtime in Your Code
The rule ships with the feature and runs in the request path. How in-code enforcement works, and how to roll it out safely.
Read guideHow do I detect and block attacks at runtime?
Detect injection, abuse, exfiltration, and agent manipulation in the handler, then deny before the query, the charge, or the model. Keep the body in process.
Read guideHow to identify AI agents and bots
Identify AI agents and bots by treating User-Agent as a claim, then verifying with reverse DNS, published IPs, or HTTP message signatures.
Read guideBot detection techniques for developers
Bot detection techniques for developers: layer User-Agent checks, verification, IP reputation, fingerprints, rate limits, and optional challenges.
Read guideIs CAPTCHA still effective, and what should you use instead?
CAPTCHA is no longer an effective primary control. Compare alternatives: adaptive rate limiting, identity-aware quotas, and behavioral bot detection.
Read guideWhat is bot spoofing and how do you detect it?
What bot spoofing is and how to detect it: verify allowlisted crawlers with reverse DNS and published IPs, then deny impersonators with isSpoofedBot.
Read guideHow do you detect bots at the application layer?
Detect bots at the application layer, where route, user, and business context reveal scraping, credential stuffing, and AI-scripted abuse.
Read guideHow to protect a React Hook Form from spam
Protect a React Hook Form from spam with shared Zod validation, rate limits, bot detection, and email checks using protectSignup on the submit route.
Read guideHow do you secure a Node.js/Express API?
Secure a Node.js Express API with Arcjet protect() middleware: Shield, detectBot allow or deny lists, and a production rate limit on each request.
Read guideHow do you secure a GraphQL API?
Secure a GraphQL API: disable introspection, cap query cost and depth, authorize every resolver, and add Arcjet plus GraphQL Armor on Apollo Server 5.
Read guideHow do you add rate limits and bot detection to a GraphQL API?
Add token-bucket rate limits and bot detection to a GraphQL API on Yoga and Next.js, then serve only SHA-256 persisted operations.
Read guideHow do you secure serverless and edge apps?
Secure serverless and edge apps by enforcing identity-aware limits and bot policy inside each handler on Lambda, Vercel, and Cloudflare Workers.
Read guideAre Next.js server actions a security risk?
Are Next.js server actions a security risk? Treat them as public HTTP APIs: validate on the server and call protect() before you write to the database.
Read guideWere you affected by the Next.js middleware bypasses?
Were you affected by the Next.js middleware bypasses? Patch CVE-2025-29927, search logs for x-middleware-subrequest, and put authorization in the handler.
Read guideHow do you prevent SQL injection and XSS in Node.js?
Prevent SQL injection and XSS in Node.js with parameterized queries, output escaping, Node.js 22 LTS, and Arcjet Shield on the request handler.
Read guideDoes Next.js need a WAF?
Does Next.js need a WAF? Yes, for scanners, known CVEs, and PCI DSS 4.0. Prefer an in-app Shield rule you can dry-run behind your existing CDN.
Read guideWhat is permissions-based security in Next.js?
Permissions-based security in Next.js: authentication names the user, Permit.io authorizes the object, and Arcjet stops attacks and abuse on the request.
Read guideHow to differentiate DoS attacks from legitimate traffic
Tell a denial-of-service flood from a large customer by identity, not volume. Compare IP, User-Agent, and application fingerprinting with edge DDoS in front.
Read guideHow to add rate limiting to SvelteKit form actions
Add Arcjet sliding-window and token-bucket rate limits to SvelteKit form actions with the v1 SvelteKit SDK, Svelte 5 runes, and npx sv create.
Read guideDynamic rate limiting with feature flags
Change Arcjet rate limits at runtime without redeploying. Drive shield and slidingWindow from LaunchDarkly client.variation() on Node 22 LTS and Express 5.
Read guideNext.js security checklist
A seven-item Next.js security checklist for App Router on Next.js 14 and 15: dependencies, validation, secrets, server-only code, headers, centralized checks, and editor or CI scanning.
Read guideRemix security checklist
Security checklist for Remix v2 and React Router 7: module side effects, signed cookies, CSRF, headers, validation, uploads, and v1 @arcjet/remix or @arcjet/react-router screening.
Read guideWeb app security checklist
A production abuse checklist for Next.js, Remix, and Nuxt: bots, identity-aware rate limits, business-logic misuse, early rejection, monitoring, and in-handler controls.
Read guideHow to secure login pages
Secure login pages against brute force, credential stuffing, SQL injection, and session attacks with fixedWindow, detectBot allow lists, and HttpOnly cookies.
Read guideSecurity advice for self-hosting Next.js in Docker
Self-host Next.js in Docker on Node 22 LTS with standalone output, a non-root user, Distroless or slim runners, and secrets from a secrets manager.
Read guideHow to secure your NestJS application with Arcjet
Secure NestJS 10 and 11 with @arcjet/nest v1: ESM setup, ArcjetModule, ArcjetGuard, WithArcjetRules, and detectBot allow lists.
Read guideStructured logging in JSON for Next.js
Add structured JSON logging to Next.js 15 with Pino via the Instrumentation hook or next-logger v5. Use serverExternalPackages and log Arcjet decisions by ID.
Read guideProtecting self-hosted Coolify apps
Protect a self-hosted Coolify host with a Tailscale private network and UFW default-deny, then expose one app on purpose with Auth.js and in-app controls.
Read guideHow do I deploy an Arcjet-protected app to Fly.io?
Deploy Arcjet on Fly.io with v1 config, Fly-Client-IP detection, rate limiting, and bot protection. Set ARCJET_KEY as a Fly secret and verify denies.
Read guideHow do I secure a container deployment?
Secure Node.js containers with a non-root USER, Node 22 on current Debian, Distroless or Wolfi bases, a read-only root, secret scanning, and signed CI deploys.
Read guideWhy do TLS certificates fail in slim Node.js containers on OrbStack?
Fix OrbStack HTTPS in Node.js containers: slim images drop the OpenSSL CA store, so set NODE_OPTIONS=--use-openssl-ca and SSL_CERT_FILE to orbstack-root.crt.
Read guideHow do I detect the client IP on Firebase?
Get the real client IP on Firebase from x-fah-client-ip after FIREBASE_CONFIG platform detection. Do not maintain Google's published proxy list.
Read guideWhy do NEXT_PUBLIC_ variables leak into the Next.js client bundle?
NEXT_PUBLIC_ env vars are inlined into the browser bundle. Scan .vercel/output, .next, and Docker images with TruffleHog, Gitleaks, Trunk, and osv-scanner.
Read guideHow do I test Next.js App Router API routes?
Test App Router Route Handlers with next-test-api-route-handler and Vitest. Mock Auth.js v5 auth(), cover broken access control, and unit-test Arcjet-protected handlers.
Read guideHow do I functionally test security rules?
Test live Arcjet rules with Newman or k6 against the same binary you deploy. v1 config is key plus rules, with a 51-iteration rate-limit collection.
Read guideWhat is a race condition attack?
A race condition attack forces two requests through the same check-then-act window so a one-time coupon, balance, or token is used twice. Close it with an atomic write.
Read guideWhat is a dependency confusion attack?
Dependency confusion installs a public package that shares an internal name, usually because the public copy has a higher version. Reserve your npm scope and bind it in .npmrc.
Read guideWhat is a trivial package?
A trivial package is a short, simple dependency you could write yourself. Concordia's 2017 npm study found 16.8% of packages met a 35-line threshold. Prefer natives such as padStart.
Read guideWhat is package hijacking?
Package hijacking is when someone else can publish a package you already trust, or serve a replacement at a URL you already pin. Cover stolen accounts, expired domains, and Polyfill.io.
Read guideWhat is secrets exfiltration?
Secrets exfiltration is the unauthorized removal of credentials, tokens, or keys from a repo, CI log, container layer, or deleted GitHub fork. IBM 2025 average: $4.44 million.
Read guideShould you store secrets in environment variables?
Avoid environment variables for production secrets. They are plaintext, easy to dump, and have no audit trail (CWE-526). Store an ID in the env and fetch at runtime.
Read guideHow do you redact sensitive data from Go logs?
Implement slog.LogValuer on types that hold secrets so only allow-listed fields are logged. log/slog has been in the standard library since Go 1.21.
Read guidePII detection for production AI applications
Running PII detection in production: per-framework placement, latency budgets, fail-open versus fail-closed per route, staged rollout, and the security review questions with answers.
Read guide