API Security Checklist is a security reference guide that provides a comprehensive checklist of countermeasures for designing, testing, and releasing APIs.
The guide addresses the core security concerns that arise throughout an API's lifecycle. It organizes security practices into distinct categories covering authentication, access control, authorization, input validation, and processing. For authentication, it recommends avoiding Basic Auth in favor of standard approaches and emphasizes proper token generation and password storage practices. For access control, it covers rate limiting, HTTPS with modern TLS versions, HSTS headers, and IP safelisting for private APIs. Authorization guidance focuses on OAuth implementation details such as server-side redirect URI validation, state parameter usage for CSRF prevention, and scope management. Input validation guidance addresses HTTP method correctness, content-type validation, user input sanitization against common vulnerabilities like XSS and SQL injection, and the proper handling of sensitive data through Authorization headers rather than URLs. The guide also recommends using API Gateway services for caching and rate limiting policies.
This checklist suits teams building or securing APIs who want a structured reference for security best practices. It works well as an onboarding resource for developers new to API security or as an audit tool for existing APIs. The guide does not position itself against alternatives; it presents itself as a standards-based compilation of established security practices.
The project maintains translations across numerous languages, indicating sustained effort to make the material accessible to a global audience. The repository accepts contributions and updates to keep the checklist current with evolving security standards and threats.
