API Security

OAuth2 is a delegation framework for authorization (user grants app access). JWT is a stateless token format often used within OAuth2 for delivering credentials. Use OAuth2 for third-party integrations; use JWT for internal API communication.

Mutual TLS (mTLS) ensures both client and server authenticate each other with certificates, eliminating man-in-the-middle attacks. Critical in zero-trust architectures and service-to-service communication.

Rate limiting throttles requests by IP/user, preventing brute force, DDoS, and API abuse. Combine with exponential backoff and adaptive rules to stay ahead of attackers.

OWASP API Security Top 10 lists the most critical API vulnerabilities: broken auth, data exposure, injection, excessive data exposure, broken access control, rate limiting failures, and six others. Master these to design secure APIs.

OAuth2 tokens are more secure: short-lived, scoped, and revocable. API keys are static and often overexposed. Use tokens for public/third-party APIs; reserve keys for internal server-to-server only.

Use a secrets manager (HashiCorp Vault, AWS Secrets Manager). Automate rotation, maintain dual-key periods for zero downtime, and audit all accesses in logs.

OWASP ZAP, Burp Suite, and Snyk perform automated vulnerability scanning. Pair with manual penetration testing and threat modeling for defense-in-depth.