Subscribe

Pillar

API Security

API security is application security with the browser chrome stripped off. The bugs look like a JWT you decoded and trusted, a GraphQL field that skipped the same check as the REST route, or a webhook that accepted any body with a familiar header.

API security tools

OpenAPI lint and fuzz for the extra field

GraphQL security tools

Bound the query

Open the list

API gateways

Hold the API front door

Open the list

Questions about API Security

How is API security different from application security?

The code is still yours. The difference is the caller: another service, a mobile app, a script, not a page you rendered. Sessions become tokens. HTML encoding matters less. Object-level authorization and replay matter more. We split the category so those lists do not get buried under XSS.

What will the first API lists cover?

How you verify a JWT without treating the payload as gospel, how you authorize a single object rather than a route, what a GraphQL resolver must check even when the REST twin already did, and how a webhook proves it came from the vendor you think it did.

Is OAuth the same as API security?

OAuth and OIDC are how you get a token. API security is what you do with that token on every request: expiry, audience, scope, and whether the resource id in the path belongs to that subject. Identity and Access will hold the IdP list. This category will hold what your API does after the token arrives.