API Security Checklist for Modern Applications
A practical checklist of the API security fundamentals most breaches actually come from — not exotic attacks, basic gaps.
Most API security incidents do not come from sophisticated attacks — they come from basic gaps: missing authorization checks, overly permissive access, and secrets handled carelessly. This checklist covers the fundamentals worth verifying on every API.
Authentication and authorization
- Authorization is checked on every request server-side — never inferred from the client.
- Object-level authorization is verified, not just endpoint-level (can user A access user B's specific record by ID?).
- Tokens have a defined expiry and refresh strategy, not indefinite validity.
Input handling
- All input is validated server-side, regardless of client-side validation.
- Rate limiting is applied per-user/per-IP on sensitive endpoints (auth, payments, search).
- File uploads are validated by content, not just file extension.
Secrets and configuration
API keys and credentials belong in environment variables or a secrets manager, never committed to source control or hardcoded. Rotate credentials on a defined schedule, and immediately if a leak is ever suspected.
Logging and monitoring
Log authentication failures, authorization failures, and unusual request patterns — not just errors. A security incident is much easier to investigate with a real audit trail than to reconstruct after the fact.
Key Takeaways
- Most API breaches come from missing basic checks, not sophisticated attacks.
- Verify object-level authorization, not just whether an endpoint requires login.
- Log authentication and authorization failures as a matter of course.
Fastly Engineering Team
This article represents the collective engineering knowledge and standards of the Fastly team, not a single author.
Fastly Engineering
Where This Gets Applied
Ideas like this one show up directly in how we scope and build client projects — not just in what we write about.
Related Articles
- Security1 min read
Building Secure Authentication Systems
Password handling, session management, and multi-factor authentication done correctly — the fundamentals that most authentication vulnerabilities trace back to.
Read Article - Architecture2 min read
Enterprise SaaS Architecture: Getting Multi-Tenancy Right
The tenancy, billing, and access-control decisions that are expensive to change later — made once, correctly, instead of retrofitted after your first ten enterprise customers.
Read Article
Related Services
Enterprise Software Development
Internal tools and enterprise systems built to integrate with existing infrastructure and meet real compliance requirements.
Learn More about Enterprise Software DevelopmentSaaS Development
End-to-end SaaS platforms, including multi-tenant architecture, billing, and the infrastructure to scale from first customer onward.
Learn More about SaaS Development
Frequently Asked Questions
Is client-side validation enough for API security?
No — client-side validation can always be bypassed. Every check that matters for security must be enforced server-side.
What is object-level authorization, specifically?
Verifying that a user is allowed to access the specific record they requested (by ID), not just that they are logged in and allowed to hit the endpoint at all — a common and serious gap.
Ready to Apply This to Your Project?
Reading about it is one thing — tell us what you're building and we'll respond directly.