1 What is API security?
This chapter covers
- What is API security?
- What is security-by-design for APIs?
- Why does API security matter?
- What are attack vectors in an API?
- How does API security fit into the API development cycle?
- How to keep pace with the field of API security
APIs are everywhere. Accounting for 57% of all web traffic (https://www.cloudflare.com/2024-api-security-management-report/), APIs are the engines that power the Internet. They allow organizations to offer services through well-defined interfaces. They power browser- and mobile-based applications. They enable service-to-service communication. They accelerate automation and bring uniform interfaces to core platforms. More and more organizations are discovering the benefits of APIs to optimize their services, automate their processes, and tap into new lines of business.
But here’s the thing: APIs represent gateways into our systems. Every time we create an API, we open a door that allows users to access data and functionality from our system. Of course, that’s the goal of an API: to expose data and functionality. And when properly implemented and secured, APIs are great. The danger comes when APIs aren’t properly secured.