API security, explained
APIs expose business logic and data directly, so they are a primary attack surface. The OWASP API Security Top 10 (2023 edition) lists the most common risks, led by broken object level authorization (BOLA): an attacker changes an ID in a request and reads someone else's data.
- Authentication: verify the caller with OAuth 2.0, signed JWTs, mTLS or scoped API keys.
- Authorization: check on every request that this caller may access this specific object and field.
- Input validation: validate bodies against a schema and reject unknown fields.
- Limits: apply rate limiting, pagination caps and payload size limits.
- Transport and exposure: use TLS everywhere, a strict CORS policy, and keep an inventory of every endpoint, including old versions.
Many incidents come from forgotten surface rather than clever exploits: a deprecated version still running, a debug endpoint, or a response that returns more fields than the client displays. Security fixes can also break clients, for example removing an overexposed field, so they need the same change verification as any other release. See API security best practices.
Related terms
- OAuth 2.0: OAuth 2.0 (RFC 6749) is an authorization framework that lets an app get limited, revocable access to an API on a user's behalf without their password.
- JSON Web Token (JWT): A JSON Web Token (JWT, RFC 7519) is a compact, URL-safe token of signed JSON claims, widely used as an access or ID token to authenticate API calls.
- API key: An API key is a secret string a client sends with each API request to identify its application or account for authentication, quotas and billing.
- CORS: CORS (Cross-Origin Resource Sharing) is a browser mechanism where HTTP headers let a server permit pages from other origins to read its responses.