Skip to main content

API Security

Authentication​

OAuth2​

WebAuthn​

Leveled API Keys​

Authorization​

Role-based Access Control (RBAC)​

Attribute-based Access Control (ABAC)​

Secure Communication​

HTTPS​

Rate Limiting​

Allow Listing​

API Gateway​

Error Handling​

Never return full stack traces or expose internal error messages and codes in production.

Input Validation​

Perform input validation on both client side and server side. On the server side, use dedicated input validation libraries or frameworks to enforce strict validation rules and sanitize user input.