Web Security

API security guides

Authentication, authorization, validation, monitoring, and abuse controls for APIs.

What these guides cover

API security protects an interface throughout design, implementation, deployment, operation, and retirement. The strongest baseline does not depend on one gateway or scanner: it inventories every exposed API, authenticates callers, authorizes the exact object and function, validates all inputs and downstream destinations, limits costly operations, minimizes returned data, and records enforcement decisions. These controls must account for valid-looking abuse as well as malformed attacks. Checks close to application logic are essential when policy depends on tenant ownership, workflow state, resource sensitivity, or the business meaning of an operation. Failure behavior must be explicit so a security dependency outage does not silently grant access.

Risks

Unknown, deprecated, or inconsistently protected APIs
Broken object and function-level authorization
Injection, SSRF, replay, and unsafe downstream calls
Data exposure, resource exhaustion, and weak telemetry

Control priorities

API inventory, ownership, and retirement policy
Credential validation and deny-by-default authorization
Schema, destination, signature, and replay validation
Resource limits, monitoring, and negative security tests

Recommended reading order

Work through the API security guide from inventory and identity to authorization, validation, abuse controls, data exposure, monitoring, and continuous testing. Use its checklist as both a design review and a regression-test plan.

Guides in this collection

API Security Best Practices

Authentication, object authorization, input validation, webhooks, abuse controls, and logging for production APIs.

How enterprises secure APIs against abuse and bots

Identity-aware rate limits and bot detection on the routes that matter — not only a perimeter WAF.

How do you secure a Node.js/Express API?

Secure a Node.js/Express API by calling Arcjet protect() in middleware before the route runs.

How do you secure a GraphQL API?

GraphQL security is more than an HTTP rate limit: one request can batch, alias, or nest enough work to exhaust the process.

How do you add rate limits and bot detection to a GraphQL API?

Token-bucket rate limits and bot detection on Yoga and Next.js, plus SHA-256 persisted operations.

How do you secure serverless and edge apps?

Serverless and edge apps expose many independently invocable functions, so a perimeter WAF is not enough.