Guide · Cybersecurity
Simple API Security Checklist
A practical API security checklist for startups. Rate limiting, auth, keys in backend, and more.
Checklist items should map to Authentication and Secrets pass conditions you can evidence. Primary control: Authentication
Ninety minutes that prevent a peer's incident
Before launch, walk throttles, backend-only secrets, HTTPS-only, auth on write paths, input validation, and billing alerts. A two-person team did exactly that and found a forgotten debug route echoing headers—cheaper than the incident a peer later described after skipping the list.
The list (pass/fail, with evidence)
1. Rate limit per IP/key (~100–500/min to start)
2. No third-party keys in frontend bundles
3. TLS everywhere; HTTP redirects
4. Auth on sensitive reads/writes
5. Validate and reject bad input early
6. Spend alerts at 50%/80%/100% of baseline
Cloudflare, API Gateway, and a backend proxy cover most rows. Tick only what you can link to a config or ticket.
Checklist → gated assessment
APRF Core Profile turns the same themes into pass/fail when a buyer wants framework evidence. Use this page to find gaps fast; use `/aprf/assess/` when you need a gate, not a vibe.
Next: Authentication
Open the related pillar specification for mandatory checks, artifacts, and pass conditions. Self-attest is optional.
Related
Frequently asked questions
- What is the most important API security step?
- Rate limiting. It's the fastest way to prevent abuse. Then: keys in backend, auth for sensitive endpoints, and billing alerts.
- Should API keys be in the frontend?
- No. Any key in frontend code can be extracted. Use a backend proxy for all external API calls. The frontend never touches the key.
- What is a simple API security checklist?
- Rate limiting, keys in backend, HTTPS, auth for sensitive endpoints, input validation, and billing alerts. Start with these.