API security best practices

Application Programming Interfaces (APIs) power nearly every modern digital experience: from mobile banking apps pulling transaction data to SaaS tools syncing customer records across platforms. As organizations shift to microservices architectures and public-facing APIs, the attack surface has exploded. Gartner estimates that by 2025, 30% of all cyber breaches will target API vulnerabilities, making API security best practices a core responsibility for both development and operations teams. Too often, Ops teams treat API security as an afterthought, focusing on uptime and latency while leaving critical vulnerabilities unpatched. This guide walks you through actionable, Ops-focused steps to secure your APIs, align with industry standards, and prevent costly data breaches. You’ll learn how to inventory shadow APIs, enforce zero trust access, configure gateways correctly, and build a response plan for API-specific incidents.

Why API Security Is Now a Mission-Critical Ops Priority

APIs are no longer just developer tools: they are the operational backbone of modern applications. For Ops teams managing deployment, scaling, and reliability, API security falls squarely under your mandate. Every unsecured API is a direct entry point to sensitive data, from customer PII to proprietary business logic. A 2023 survey by Salt Security found that 94% of organizations experienced an API security incident in the past year, with average breach costs exceeding $4.5 million.

Consider a mid-sized retail chain that deployed a public API for its mobile app without Ops involvement. The API lacked rate limiting, allowing attackers to scrape 10 million customer records over 3 weeks before the Ops team noticed unusual traffic spikes. This incident led to regulatory fines, churn, and reputational damage that took years to repair.

Actionable Ops Steps

• Add API security reviews to your regular Ops sprint cycles
• Assign a dedicated owner for API security across Dev and Ops teams
• Track API-related incidents as separate metrics in your Ops dashboards

Common mistake: Assuming API security is solely the development team’s responsibility. Ops teams control deployment, networking, and access controls, making their involvement non-negotiable.

Start with API Threat Modeling (Don’t Skip This Step)

API threat modeling is the process of identifying what you need to protect, who might attack your APIs, and what vulnerabilities exist in your current setup. It’s far more cost-effective to fix flaws during design than after deployment. Use the STRIDE framework (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) tailored to API-specific risks like broken object level authorization (BOLA).

For example, a payroll software company used threat modeling for a new tax calculation API and discovered that unauthenticated users could access admin endpoints by guessing numeric IDs. They added authorization checks before writing a single line of production code, avoiding a potential breach that would have exposed employee salary data.

Core Threat Modeling Steps

• Catalog all APIs (public, internal, third-party, shadow APIs)
• Map data flows to identify which endpoints handle sensitive information
• Prioritize high-risk APIs that process PII or payment data

Common mistake: Only modeling public APIs and ignoring internal APIs, which are often less protected and targeted in lateral movement attacks.

Enforce Strong API Authentication (No More Hardcoded Keys)

API authentication verifies the identity of the user, application, or service making a request. Weak authentication is one of the top causes of API breaches. When evaluating best API authentication methods 2024, prioritize OAuth 2.0 or mTLS for high-risk endpoints, and avoid basic auth or hardcoded API keys in client-side code.

A fitness startup embedded static API keys in its mobile app to connect to its backend. An attacker decompiled the app, extracted the keys, and accessed 500,000 user profiles. The company had to rotate all keys, force password resets for affected users, and rebuild its authentication flow from scratch.

Authentication Best Practices

• Use OAuth 2.0 with short-lived JWTs for user-facing APIs
• Rotate API keys every 60 to 90 days, or immediately if compromised
• Never store secrets in code repositories or client-side applications

Common mistake: Using basic auth over unencrypted HTTP, which sends credentials as easily decodable base64 strings.

What is API authentication? API authentication is the process of verifying the identity of a user, application, or service trying to access an API endpoint, ensuring only legitimate entities can make requests.

Implement Granular API Authorization (BOLA Is the #1 Threat)

API authorization defines what an authenticated entity is allowed to access, while authentication only verifies who they are. The OWASP API Top 10 2023 lists BOLA (Broken Object Level Authorization) as the top API risk: it occurs when APIs don’t check if a user has permission to access a specific data object, like another user’s records.

A telehealth app allowed patients to view their medical records via an API endpoint that took a record ID as a parameter. No object-level checks were in place, so any authenticated user could change the ID to view other patients’ sensitive health data. The vulnerability was exploited for months before a penetration test caught it.

Authorization Action Items

• Add object-level permission checks to every request that accesses user-specific data
• Use policy-based access control (PBAC) to define granular permissions per role
• Never rely on client-side checks to enforce authorization rules

Common mistake: Assuming authentication is sufficient, and skipping per-object permission validation for internal APIs.

Encrypt All API Traffic (TLS Is Non-Negotiable)

TLS encryption protects data in transit between API clients and servers, preventing man-in-the-middle attacks that intercept sensitive information. All APIs, including internal service-to-service endpoints, must use TLS 1.2 or higher. Follow Google’s API Security Best Practices to disable weak cipher suites and enforce HTTP Strict Transport Security (HSTS).

A regional hospital transmitted patient data via internal APIs over unencrypted HTTP, assuming its internal network was secure. An attacker breached a low-level billing system and intercepted unencrypted API traffic, stealing 20,000 patient records. The hospital faced $2.3 million in HIPAA fines.

Encryption Checklist

• Enforce TLS 1.2+ for all API endpoints, public and internal
• Disable SSLv3, TLS 1.0, and weak cipher suites like RC4
• Redirect all HTTP API requests to HTTPS automatically

Common mistake: Only encrypting public APIs and leaving internal APIs unencrypted, even though internal networks are frequently breached.

Do all APIs need TLS encryption? Yes, every API endpoint (public, internal, third-party) must use TLS 1.2 or higher to encrypt data in transit, even if it’s on a trusted internal network.

Deploy and Configure an API Gateway Correctly

An API gateway acts as a central entry point for all API traffic, letting you enforce security policies uniformly across hundreds of endpoints. It handles authentication, rate limiting, logging, and encryption in one place, reducing the burden on individual development teams. Our API Gateway Configuration Guide walks through setup for common open-source and cloud-native tools.

A fintech company deployed a Kong API gateway and used it to block 100,000 malicious requests in a single day by enforcing IP-based rate limits. Before the gateway, each API team implemented their own rate limiting, leading to inconsistent policies and gaps that attackers exploited.

Gateway Configuration Tips

• Route all API traffic through the gateway, never expose endpoints directly to the internet
• Define custom security policies per API (stricter rules for APIs handling payment data)
• Audit gateway logs weekly to spot unauthorized access attempts

Common mistake: Using default gateway settings without customizing policies for your organization’s specific API risks.

Implement Smart Rate Limiting and Throttling

Rate limiting restricts the number of requests a user, IP, or application can make to an API in a given time period, preventing DDoS attacks, credential stuffing, and data scraping. For step-by-step instructions, review our guide to how to implement API rate limiting for different API gateway tools.

A social media platform skipped rate limiting for its user profile API, assuming its authentication checks were sufficient. Attackers launched a credential stuffing attack that made 1 million login attempts in an hour, taking down the API for 4 hours and locking out legitimate users.

Rate Limiting Best Practices

• Set per-user, per-IP, and per-endpoint limits based on normal usage patterns
• Use sliding window algorithms instead of fixed windows to prevent burst attacks
• Return 429 Too Many Requests status codes with retry-after headers

Common mistake: Setting a single global rate limit for all APIs, instead of stricter limits for high-risk endpoints like authentication or payment APIs.

Validate All API Input (Prevent Injection Attacks)

Input validation ensures that API requests only contain expected, safe data, preventing SQL injection, NoSQL injection, and mass assignment attacks. Validate all input against a predefined schema (like OpenAPI or JSON Schema) and sanitize data to remove malicious characters before processing.

A travel booking site didn’t validate API input for its flight search endpoint. An attacker sent a SQL injection payload in the destination parameter, which deleted all booking records in the production database. The site was offline for 12 hours while the team restored from backup.

Input Validation Steps

• Define strict schemas for all API request and response payloads
• Validate input server-side, never rely on client-side validation alone
• Reject malformed or oversized requests immediately with 400 Bad Request errors

Common mistake: Only validating required fields and ignoring optional parameters, which attackers often use to smuggle malicious payloads.

Manage API Keys and Secrets Securely

Hardcoded API keys, exposed credentials, and poor secret rotation are responsible for 1 in 5 API breaches. Use dedicated secret management tools instead of storing keys in environment variables or code repositories. NIST SP 800-204A provides detailed guidelines for API key lifecycle management.

A developer committed an AWS API key to a public GitHub repository for a personal project. Attackers scraped the key within hours and used it to spin up cryptocurrency miners in the company’s production cloud environment, racking up $12,000 in unexpected charges.

Secret Management Tips

• Use tools like HashiCorp Vault or AWS Secrets Manager to store and rotate keys
• Audit key usage monthly and revoke unused or inactive keys immediately
• Never share API keys via email, Slack, or other unencrypted channels

Common mistake: Using the same API key across development, staging, and production environments, so a single breach compromises all tiers.

Test Your APIs Continuously (Shift Left + Ops Monitoring)

API security testing can’t be a one-time event. Integrate automated scans into your CI/CD pipeline to catch vulnerabilities before production, and run regular penetration tests on live APIs. Align all testing with the OWASP API Top 10, the industry standard list of critical API risks updated in 2023.

A SaaS company runs OWASP API Top 10 scans on every code commit, which caught a BOLA vulnerability in a new feature before it reached production. The fix took 2 hours, compared to the 14 days it would have taken to patch and redeploy after launch.

Testing Checklist

• Run SAST (static) and DAST (dynamic) scans on all API code
• Test for OWASP API Top 10 risks like BOLA, broken auth, and excessive data exposure
• Monitor API logs for anomaly patterns like unusual request volumes or error rates

Common mistake: Only testing APIs at launch and failing to retest as code, dependencies, and endpoints change over time.

What is the OWASP API Top 10? The OWASP API Top 10 is a list of the 10 most critical API security vulnerabilities, updated regularly, that development and Ops teams use to prioritize mitigation efforts.

Adopt Zero Trust Principles for API Access

Zero trust assumes no request is trustworthy by default, even if it comes from a known internal IP or authenticated user. Every API request must be verified for identity, device posture, and context before access is granted. This is especially critical for service-to-service APIs, where mTLS (mutual TLS) can verify both client and server identities.

An enterprise company adopted zero trust for its internal APIs, requiring device compliance checks (up-to-date antivirus, disk encryption) in addition to user authentication. When an attacker stole an employee’s credentials, the zero trust check blocked the request from an unmanaged personal device, preventing a breach.

Zero Trust Implementation Steps

• Verify every request’s identity, device, and context, even from internal networks
• Use mTLS for service-to-service APIs to enable mutual identity verification
• Log all access decisions to audit zero trust policy enforcement

Common mistake: Assuming internal APIs are safe because they’re behind a corporate firewall, and skipping zero trust checks for internal traffic.

Build an API-Specific Incident Response Plan

Generic incident response plans often don’t account for API-specific risks, like compromised API keys or BOLA exploitation. Ops teams need a dedicated plan that includes steps to revoke keys, block malicious IPs, and notify affected users quickly. Download our Incident Response Template to customize for your API footprint.

A media company had no API-specific response plan when it discovered a breach of its subscriber API. It took 72 hours to revoke all compromised keys and block attacker IPs, during which time 1 million subscriber emails were stolen. A peer company with a pre-built API response plan contained a similar breach in 4 hours.

Response Plan Must-Haves

• Define roles for Dev, Ops, and legal teams during an API breach
• Include steps to rotate all API keys used in the affected scope
• Test the plan quarterly with simulated API breach scenarios

Common mistake: Using a generic network breach plan without API-specific steps, leading to delayed containment and larger impact.

Comparison of Common API Authentication Methods

Essential Tools for API Security

• OWASP ZAP: Free, open-source dynamic security testing tool that scans APIs for OWASP API Top 10 vulnerabilities. Use case: Automated API scans in CI/CD pipelines.
• HashiCorp Vault: Secret management platform for storing and rotating API keys, certificates, and credentials. Use case: Eliminating hardcoded secrets in code and environment variables.
• Kong API Gateway: Open-source API gateway that enforces rate limiting, authentication, and access control at scale. Use case: Centralized API security policy enforcement for public and internal APIs.
• Snyk API Security: Scans API schemas and code for vulnerabilities aligned with the OWASP API Top 10. Use case: Shift-left API security testing during development.

Real-World Case Study: E-Commerce API Security Overhaul

Problem: A mid-sized e-commerce company operated 52 public APIs across its web and mobile platforms, with no central inventory. During a routine Ops audit, the team discovered a BOLA vulnerability in its order management API, which allowed any authenticated user to view other customers’ order details by changing a numeric order ID in the request. At the time, 200,000 unencrypted order records were exposed.

Solution: The Ops team partnered with development to implement a three-part fix: first, deploy a Kong API gateway to centralize all API traffic and enforce rate limiting and authentication. Second, add object-level authorization checks to all order-related endpoints. Third, integrate OWASP API Top 10 scans into their CI/CD pipeline to catch vulnerabilities before production.

Result: Within 6 months, the company reported zero API-related security incidents. Malicious API traffic dropped by 85% thanks to gateway-enforced rate limiting, and the time to patch critical API vulnerabilities fell from 14 days to 2 days. Customer trust scores rebounded to pre-breach levels within a year.

Top 7 API Security Mistakes Ops Teams Make

• Forgetting to decommission deprecated APIs: Old, unpatched APIs often remain accessible long after they’re retired, creating unmonitored attack surfaces.
• Not logging API request data: Without logs of request IPs, user agents, and payloads, you can’t investigate incidents or spot anomalies.
• Using default credentials for API gateways or management tools: Attackers scan for default admin passwords on popular API tools.
• Ignoring third-party API security: APIs you consume from vendors can be just as risky as the ones you expose.
• Not training Ops staff on API-specific threats: Traditional network security training doesn’t cover BOLA, mass assignment, or other API-specific risks.
• Skipping encryption for internal APIs: Internal networks are frequently breached, and unencrypted internal API traffic is easy to intercept.
• Failing to inventory shadow APIs: APIs deployed outside official channels (by individual developers or teams) often lack security controls.

6-Step API Security Implementation Checklist for Ops

1. Inventory all APIs: Use automated scanning tools to find all public, internal, and shadow APIs across your environment. Document their purpose, data handled, and access levels.
2. Prioritize high-risk targets: Focus first on APIs that handle sensitive data (PII, payment info), are publicly accessible, or have known vulnerabilities.
3. Deploy a centralized API gateway: Route all API traffic through the gateway to enforce authentication, rate limiting, and encryption uniformly.
4. Implement core security controls: Add TLS 1.2+ encryption, strong authentication (OAuth 2.0/JWT), and granular authorization to all high-risk APIs.
5. Set up continuous monitoring: Log all API requests, configure alerts for unusual traffic (e.g., high request volumes from a single IP), and run weekly vulnerability scans.
6. Build an API-specific incident response plan: Define steps to revoke compromised keys, block malicious IPs, and notify affected users, and test the plan quarterly.

Frequently Asked Questions About API Security

What are the OWASP API Top 10 vulnerabilities?

The OWASP API Top 10 is a list of the 10 most critical API security risks, updated in 2023. It includes BOLA, broken authentication, excessive data exposure, lack of resource rate limiting, and other common flaws that lead to breaches.

How often should API keys be rotated?

Rotate API keys every 60 to 90 days as a baseline. If you suspect a key is compromised, rotate it immediately, and audit all recent requests made with the key.

Do internal APIs need security controls?

Yes. Internal APIs are frequently targeted in lateral movement attacks, where attackers breach a low-security internal service to access more sensitive systems. Encrypt all internal API traffic and enforce zero trust access checks.

What is the difference between API authentication and authorization?

Authentication verifies the identity of the entity making the request (who are you?). Authorization verifies what that entity is allowed to access (what can you do?). Both are required for robust API security.

How can I find shadow APIs in my environment?

Use automated API discovery tools that scan your network traffic, cloud environments, and code repositories for unlisted APIs. Regular Ops audits of deployed services also help surface shadow APIs.

What is BOLA and how do I prevent it?

BOLA (Broken Object Level Authorization) is a vulnerability where APIs don’t check if a user has permission to access a specific object (e.g., another user’s data). Prevent it by adding object-level permission checks to every API request that accesses user-specific data.

Final Takeaways

Implementing API security best practices is not a one-time project, but an ongoing operational process. As your API footprint grows, your security controls must scale with it. Start with a full API inventory, prioritize high-risk endpoints, and lean on centralized tools like API gateways to enforce policies uniformly. Remember that API security requires collaboration between Dev and Ops teams: developers build secure code, but Ops teams ensure that security controls are deployed, monitored, and updated over time. Use the OWASP API Top 10 Guide as your baseline, test continuously, and never assume an API is safe because it’s internal. The cost of proactive API security is a fraction of the cost of a breach.

For more operational security resources, review our DevOps Security Checklist to align API security with your broader infrastructure protection efforts.