Checklists do not replace judgment, but they keep well-understood mistakes from shipping. This guide groups API security concerns into a few durable buckets.
Authentication
- Issue short-lived tokens and support rotation and revocation.
- Validate token signature, audience, issuer, and expiry on every request.
Authorization
- Enforce object-level authorization on the server for every resource access.
- Enforce function-level authorization so privileged operations are gated by role, not merely hidden from the UI.
Input and output
- Validate request bodies against a schema and reject unexpected fields.
- Set explicit response schemas so sensitive fields are never returned by accident.
Operability
- Rate-limit by identity and by endpoint sensitivity.
- Log authorization decisions with enough context to investigate abuse.
Work the list during design review, not after an incident.
Sample content created for development and testing.