Open Skills Logo
Open Skills

api-security-best-practices

Implement secure API design patterns including authentication, authorization, input validation, rate limiting, and protection against common API vulnerabilities

Author

@sickn33

Category

Development Tools

Install

Hot:7

Download and extract to your skills directory

Copy command and send to OpenClaw for auto-install:

Download and install this skill https://openskills.cc/api/download?slug=sickn33-skills-api-security-best-practices&locale=en&source=copy

API Security Best Practices - Building Secure and Reliable API Interfaces

Skill Overview

API Security Best Practices is an intelligent assistant focused on API security, helping developers design and implement authentication and authorization, input validation, rate limiting protections, and vulnerability defenses, covering various API types such as REST, GraphQL, and WebSocket.

Applicable Scenarios

1. Designing and developing new API endpoints

Before starting development of a new endpoint, it helps you plan the security architecture: choose appropriate authentication methods (JWT, OAuth 2.0, or API Key), design permission control models, plan input validation rules, and configure reasonable rate limiting strategies.

2. Hardening the security of existing APIs

Perform security audits and hardening for existing APIs: check authentication and authorization vulnerabilities, fix input validation issues, add rate limiting protections, strengthen data-in-transit encryption, and optimize error handling to avoid information disclosure.

3. Responding to API security issues and attacks

When APIs encounter attacks or security issues, provide solutions: respond to malicious API scraping/abuse, fix injection vulnerabilities, handle authentication bypasses, configure protective rules, and implement security hardening.

Core Features

1. Authentication and Authorization Implementation

Help you implement a complete API authentication and authorization system:

  • Full implementation of JWT token authentication (login, verification, refresh)

  • OAuth 2.0 integration guide

  • Role-Based Access Control (RBAC) design

  • Multi-Factor Authentication (MFA) implementation solutions

  • Session management and token security configuration

    • 2. Input Validation and Injection Protection

    Security practices to prevent various injection attacks:

  • Request parameter validation and schema checks

  • SQL injection protection (parameterized queries, using an ORM)

  • XSS and command injection defenses

  • Secure validation for file uploads

  • Output sanitization to prevent XSS

    • 3. Rate Limiting and DDoS Protection

    Protect APIs from abuse and attacks:

  • Rate limiting implemented per user/IP

  • Redis-based distributed rate limiting solutions

  • Layered rate limiting strategies (public endpoints vs authenticated endpoints)

  • Security header configurations (Helmet.js)

  • Request quotas and graceful degradation handling

    • Frequently Asked Questions

    What is the difference between API authentication and authorization?

    Authentication is verifying "who you are," confirming user identity; authorization is verifying "what you can do," confirming user permissions. A common approach is to first perform authentication using JWT or sessions, then use RBAC or ABAC to determine whether a user has permission to access a specific resource. Many security vulnerabilities arise from performing authentication only while neglecting authorization checks.

    How can I prevent APIs from being maliciously abused?

    The most effective solution is to implement multi-layer rate limiting: use IP-level limits for public APIs (e.g., 100 requests per 15 minutes) and stricter limits for authentication endpoints (e.g., 5 requests per 15 minutes). It is recommended to use Redis to store counters for distributed rate limiting. Combine this with measures such as adding CAPTCHAs, detecting anomalous behavior patterns, setting account-level quotas, monitoring high-frequency requests, and automatically blocking offenders.

    How do I choose between JWT and OAuth 2.0?

    JWT is suitable for building your own authentication system—simple, stateless, and easy to scale. OAuth 2.0 is suitable for scenarios requiring third-party logins or complex authorization, such as supporting WeChat or Google login, or needing cross-service delegated access. For most small-to-medium applications, JWT is sufficient; consider OAuth 2.0 for large platforms or scenarios that require open APIs.