Protect a public API with layered controls across design, deployment, runtime, and ongoing operations. Authenticate callers, authorize every action and object, limit resource use and abuse-prone workflows, keep an accurate endpoint inventory, and treat data from integrations as untrusted. No single token, gateway, or rate limit provides complete protection.
What public API security needs to cover
A public API is reachable by callers you do not fully control. “Public” describes its exposure, not whether every endpoint should be anonymous. Partner, mobile, internal, and administrative interfaces may all need different authentication, authorization, and network access rules.
As an Amazon Associate I earn from qualifying purchases.
Use API security as a lifecycle practice: identify risks and build protections before deployment, then enforce, monitor, test, and adjust them at runtime. NIST Special Publication 800-228, Guidelines for API Protection for Cloud-Native Systems, was published in June 2025 and its page lists updates through March 13, 2026. It describes basic and advanced controls for both pre-runtime and runtime work, with incremental choices based on risk.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Use the OWASP list as a checklist, not a ranking
The OWASP API Security Top 10 (2023) is an awareness taxonomy of ten distinct risk areas:
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Broken object-level authorization
- Broken authentication
- Broken object-property authorization
- Unrestricted resource consumption
- Broken function-level authorization
- Unrestricted access to sensitive business flows
- Server-side request forgery
- Security misconfiguration
- Improper inventory management
- Unsafe consumption of APIs
These categories help teams review a threat model; they are not a guarantee that all relevant risks are covered or a statistically measured ranking of attack frequency. In its 2023 methodology, the OWASP API Security team said its call for data did not produce data suitable for relevant statistical analysis.
How to protect a public API
1. Inventory the attack surface
Keep a maintained record of API hosts, routes, versions, owners, data classes, dependencies, and authentication expectations. Include partner, mobile, internal, administrative, and externally reachable interfaces. Reconcile the intended inventory with deployed configuration and observed traffic where feasible, so an undocumented route or forgotten host does not remain invisible.
Remove obsolete versions or restrict them to callers that still need them. Remove debug routes and undocumented deployments from production, or protect them as tightly as other sensitive interfaces. Assign owners and review dates to endpoints and versions so teams can decide when to retire them.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
2. Authenticate callers and protect credentials
Choose an authentication approach for the client type and the sensitivity of the API. Protect tokens and secrets in transit and storage, limit who can issue or retrieve them, and have a process to revoke or rotate compromised credentials. Do not treat an API key as proof of a human identity or as sufficient authorization for a sensitive action.
For OAuth 2.0, follow current protocol guidance rather than copying an old flow diagram. The OWASP OAuth 2.0 Protocol Cheat Sheet recommends PKCE for public clients using the authorization code flow. PKCE helps address authorization-code interception; it does not by itself protect access tokens. Where the risk calls for stronger binding between a token and its client, consider sender-constrained tokens and the other token-protection measures appropriate to the deployment.
3. Authorize every object, property, and function
Authentication answers who presented a valid identity or credential. Authorization answers whether that principal may perform this specific operation on this specific resource. Check authorization where the data or action is accessed, on every request; do not assume that a valid token or an earlier successful check grants access to other objects or functions.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Object-level: Verify that the caller may access the particular record identified in the request. A caller changing an identifier must not gain access to another user’s data.
- Property-level: Decide which fields the caller may read or change. Allowlist writable properties instead of binding arbitrary request fields into internal models.
- Function-level: Enforce roles and permissions for privileged operations, including administrative functions, regardless of whether a caller can reach the route.
Keep these decisions server-side and deny by default. Test with multiple users and roles: substitute object identifiers, submit fields a user should not control, and attempt privileged operations using an ordinary account.
Recommended Free Tools
4. Bound consumption and protect sensitive workflows
Set limits for payload size, pagination, query complexity, concurrency, expensive operations, and downstream resource use. Use quotas and throttles that account for the caller, operation, and expected use, and consider the costs imposed on dependencies as well as the API itself.
Protect sensitive business flows—such as purchases, posts, account recovery, or sending paid messages—from automated abuse with controls suited to the harm an attacker could cause. Request-volume limits alone may not stop abuse of a workflow that is inexpensive to call but costly to the business or its users. There is no universal safe requests-per-second threshold: set limits using service capacity, operating costs, normal user behavior, and the consequences of abuse.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
5. Reduce misconfiguration and server-side request risks
Use secure defaults and review the whole path from gateway to origin. Restrict management interfaces, remove debug behavior, and check CORS, TLS, error handling, security headers, and gateway and origin configuration. Ensure that a perimeter control is not bypassed by a directly reachable origin.
If a caller can cause the server to fetch a URL, validate the destination against an allowlist and block access to internal or otherwise unintended networks. Treat URL fetching as a server-side request forgery risk, not simply as an input-format question.
Free tools Windows power users keep installed
One-click scans. No signup required.
6. Treat third-party API responses as untrusted input
TLS protects data in transit, but it does not establish that a response from another API is safe to use. Validate and sanitize returned data before storing it or passing it to another component. Constrain redirects to known destinations, set timeouts, and limit response sizes and other resource use. Consider how compromised or malicious responses could lead to injection, data exposure, or service exhaustion.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
7. Log, detect, test, and respond
Record security-relevant events such as authorization failures, token failures, unusual access patterns, configuration changes, and high-cost operations. Avoid logging secrets and unnecessary sensitive data. Alert on patterns that may indicate identifier enumeration, workflow abuse, or unexpected use of endpoints.
Test authorization boundaries and abuse cases during development and deployment. When an incident or a newly deployed endpoint changes the threat picture, update the inventory and threat model, then adjust pre-runtime and runtime controls accordingly.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to decide which controls to implement first
Prioritize according to exposed data, the impact of unauthorized actions, likely abuse, and the cost of failure. Start with a reliable endpoint inventory and server-side authorization, then address the resource limits, workflow controls, configuration risks, and monitoring that fit the API’s threat model. NIST SP 800-228 describes basic and advanced protections as choices teams can apply incrementally according to risk rather than as a single mandatory implementation pattern.
If evaluating a gateway, cloud-edge service, service mesh, application library, or a combination, assess the fit against the actual API and its enforcement points:
- Coverage: Does it help with endpoint discovery, authorization testing, runtime enforcement, abuse controls, and observability—or only some of them?
- Enforcement depth: Can it enforce object- and function-level decisions, or does it mainly apply perimeter traffic rules?
- Deployment fit: Where does policy run relative to the gateway, origin, and services? Can the origin be reached without passing through it?
- Operational impact: Account for integration effort, latency, false positives, telemetry, staff ownership, and ongoing policy maintenance.
- Evidence: Validate documented capabilities against your own threat model and tests rather than assuming a product label means complete coverage.
What API security guidance does—and does not—establish
The OWASP API Security Top 10 is a practical way to check whether a design or review has considered common categories of API risk. It should not be presented as a frequency ranking: the OWASP API Security team’s 2023 methodology states that its public call for data did not enable relevant statistical analysis. The list also does not replace an API-specific threat model, testing, or runtime monitoring.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
