What is API Security?

What is API Security?

API security is the set of controls that make sure an API returns only the data, and performs only the actions, that a verified client is allowed to use. It combines authentication, authorization, encryption in transit, input validation and rate limiting, backed by monitoring. Because most apps talk through APIs, the API is often the main attack surface.

How API security works

No single control is enough, so each request passes several layers. Each layer answers a different question:

• Authentication: who is calling? An API key, an OAuth 2.0 access token (sent as a bearer token), a signed JWT or a client certificate (mTLS). Keep credentials short-lived where you can, scoped, and out of client-side code and source control.
• Authorization: what may this caller do? Checked on the server for every request and every object, never inferred from a role or ID the client sends.
• Encryption: can anyone in the middle read it? TLS on all traffic, certificates that are validated and renewed in time.
• Input validation: is this request safe to process? Check type, length, format and range against a strict schema, and reject unknown fields.
• Rate limiting: how much is too much? Per-client and per-endpoint limits slow brute force, scraping and abuse of expensive endpoints.

Example: broken object level authorization

The most common serious flaw is a server that authenticates the caller but never checks who owns the object. Changing one ID in the URL is enough:

GET /api/orders/1001   (token of user A)  -> 200 OK, A's order
GET /api/orders/1002   (token of user A)  -> 200 OK, B's order  <- broken object level authorization
GET /api/orders/1002   (token of user A)  -> 403 Forbidden      <- what the server should answer

Authentication vs authorization

The OWASP API Security Top 10 (2023)

The OWASP API Security Top 10 is the shared checklist most teams use to prioritize. The 2023 edition lists: broken object level authorization, broken authentication, broken object property level authorization, unrestricted resource consumption, broken function level authorization, unrestricted access to sensitive business flows, server side request forgery, security misconfiguration, improper inventory management and unsafe consumption of APIs. Our entry on the top API security risks goes through them, and API attacks covers how they are exploited.

Common API security mistakes

• Trusting the client: a role, user ID or price sent in the request body.
• Returning whole database objects and hiding fields in the front end.
• Leaving old API versions and undocumented endpoints running.
• Putting keys or tokens in mobile apps, JavaScript bundles or Git history.
• Relying on a gateway or WAF alone. They are a useful perimeter layer, but they cannot know who should see which record.
• Setting rate limits without ever checking what the API does when they are hit.

Testing and monitoring API security

Use layers: static analysis and dependency scanning in the pipeline, dynamic testing and fuzzing against a running API, explicit tests that try to reach another tenant's data, and periodic penetration tests. See API security audit for the review side.

LoadFocus is not a vulnerability scanner, but two parts of the job fit it. Load testing shows how an API and its rate limits behave under heavy traffic before production does (JMeter and k6 scripts, 25 cloud regions); see common causes of API rate limiting and testing OAuth 2.0 secured APIs. API monitoring runs scheduled checks (free checks every 5 minutes) that assert on status code, headers and response body, so a login endpoint that suddenly answers 200 to a bad key, or an expiring SSL certificate, raises an alert. More in API monitoring.

FAQ: API security

What is API security in simple terms?

It is everything that keeps an API from sharing data or running actions for the wrong caller: proving who the caller is, checking what they may do, encrypting the traffic, validating input and limiting how fast it can be used.

What is the difference between authentication and authorization?

Authentication confirms who the client is. Authorization decides what that client may access. A system can authenticate correctly and still leak data if authorization is missing on some objects.

Is an API gateway or WAF enough?

No. They centralize authentication checks, rate limiting and pattern blocking, but flaws in business logic, such as reading someone else's order, have to be fixed inside the service.

How does rate limiting help API security?

It caps requests per client in a time window, which slows credential stuffing, scraping and abuse of expensive endpoints. Test the limits under load to confirm they hold and that errors are clean.

How do I test an API for security?

Combine automated scanning, fuzzing, authorization tests that cross tenants, load tests of your throttling and a periodic manual penetration test. Add monitoring so regressions show up after release.