API Security Best Practices

Implement secure API design patterns including authentication, authorization, input validation, rate limiting, and protection against common API vulnerabilities

Dokhacgiakhoa Updated Sep 9, 2026 505 repo stars

Install

Press C to copy

$ npx skillmds@latest add dokhacgiakhoa/api-security-best-practices

Installs into ~/.claude/skills (or .claude/skills inside a project). Restart Claude Code to pick it up.

＋ Add to plugin

README badge

[![SkillMD](https://skillmd.com/badge/dokhacgiakhoa/api-security-best-practices.svg)](https://skillmd.com/skills/dokhacgiakhoa/api-security-best-practices)

Trust & safety

2 of 3 audits passed

Last audited Sep 24, 2026 · commit 9514643

Permissions this skill uses

Makes network calls
The instructions fetch remote URLs or call external services.
Reads secrets
The instructions read tokens, keys, or other credentials.

Works with: Claude Code Claude.ai OpenAI Codex +

File contents

API Security Best Practices

Overview

Guide developers in building secure APIs by implementing authentication, authorization, input validation, rate limiting, and protection against common vulnerabilities. This skill covers security patterns for REST, GraphQL, and WebSocket APIs.

When to Use This Skill

Use when designing new API endpoints
Use when securing existing APIs
Use when implementing authentication and authorization
Use when protecting against API attacks (injection, DDoS, etc.)
Use when conducting API security reviews
Use when preparing for security audits
Use when implementing rate limiting and throttling
Use when handling sensitive data in APIs

How It Works

🧠 Knowledge Modules (Fractal Skills)

1. Step 1: Authentication & Authorization

2. Step 2: Input Validation & Sanitization

3. Step 3: Rate Limiting & Throttling

4. Step 4: Data Protection

5. Step 5: API Security Testing

6. Example 1: Implementing JWT Authentication

7. Authentication Flow

8. Implementation

9. Security Best Practices

10. Example 2: Input Validation and SQL Injection Prevention

11. The Problem

12. The Solution

13. Validation Checklist

14. Example 3: Rate Limiting and DDoS Protection

15. Why Rate Limiting?

16. Implementation with Express Rate Limit

17. Advanced: Per-User Rate Limiting

18. DDoS Protection with Helmet

19. Rate Limit Response Headers

20. ✅ Do This

21. ❌ Don't Do This

22. Problem: JWT Secret Exposed in Code

23. Problem: Weak Password Requirements

24. Problem: Missing Authorization Checks

25. Problem: Verbose Error Messages

26. Authentication & Authorization

27. Input Validation

28. Rate Limiting & DDoS Protection

29. Data Protection

30. Monitoring & Logging

---name: api-security-best-practicesdescription: Implement secure API design patterns including authentication, authorization, input validation, rate limiting, and protection against common API vulnerabilities--- # API Security Best Practices ## Overview Guide developers in building secure APIs by implementing authentication, authorization, input validation, rate limiting, and protection against common vulnerabilities. This skill covers security patterns for REST, GraphQL, and WebSocket APIs. ## When to Use This Skill - Use when designing new API endpoints - Use when securing existing APIs - Use when implementing authentication and authorization - Use when protecting against API attacks (injection, DDoS, etc.) - Use when conducting API security reviews - Use when preparing for security audits - Use when implementing rate limiting and throttling - Use when handling sensitive data in APIs ## How It Works ## 🧠 Knowledge Modules (Fractal Skills) ### 1. [Step 1: Authentication & Authorization](./sub-skills/step-1-authentication-authorization.md) ### 2. [Step 2: Input Validation & Sanitization](./sub-skills/step-2-input-validation-sanitization.md) ### 3. [Step 3: Rate Limiting & Throttling](./sub-skills/step-3-rate-limiting-throttling.md) ### 4. [Step 4: Data Protection](./sub-skills/step-4-data-protection.md) ### 5. [Step 5: API Security Testing](./sub-skills/step-5-api-security-testing.md) ### 6. [Example 1: Implementing JWT Authentication](./sub-skills/example-1-implementing-jwt-authentication.md) ### 7. [Authentication Flow](./sub-skills/authentication-flow.md) ### 8. [Implementation](./sub-skills/implementation.md) ### 9. [Security Best Practices](./sub-skills/security-best-practices.md) ### 10. [Example 2: Input Validation and SQL Injection Prevention](./sub-skills/example-2-input-validation-and-sql-injection-prevention.md) ### 11. [The Problem](./sub-skills/the-problem.md) ### 12. [The Solution](./sub-skills/the-solution.md) ### 13. [Validation Checklist](./sub-skills/validation-checklist.md) ### 14. [Example 3: Rate Limiting and DDoS Protection](./sub-skills/example-3-rate-limiting-and-ddos-protection.md) ### 15. [Why Rate Limiting?](./sub-skills/why-rate-limiting.md) ### 16. [Implementation with Express Rate Limit](./sub-skills/implementation-with-express-rate-limit.md) ### 17. [Advanced: Per-User Rate Limiting](./sub-skills/advanced-per-user-rate-limiting.md) ### 18. [DDoS Protection with Helmet](./sub-skills/ddos-protection-with-helmet.md) ### 19. [Rate Limit Response Headers](./sub-skills/rate-limit-response-headers.md) ### 20. [✅ Do This](./sub-skills/do-this.md) ### 21. [❌ Don't Do This](./sub-skills/dont-do-this.md) ### 22. [Problem: JWT Secret Exposed in Code](./sub-skills/problem-jwt-secret-exposed-in-code.md) ### 23. [Problem: Weak Password Requirements](./sub-skills/problem-weak-password-requirements.md) ### 24. [Problem: Missing Authorization Checks](./sub-skills/problem-missing-authorization-checks.md) ### 25. [Problem: Verbose Error Messages](./sub-skills/problem-verbose-error-messages.md) ### 26. [Authentication & Authorization](./sub-skills/authentication-authorization.md) ### 27. [Input Validation](./sub-skills/input-validation.md) ### 28. [Rate Limiting & DDoS Protection](./sub-skills/rate-limiting-ddos-protection.md) ### 29. [Data Protection](./sub-skills/data-protection.md) ### 30. [Monitoring & Logging](./sub-skills/monitoring-logging.md)

Dokhacgiakhoa/Agent-Skills-4-Vibe-Coding-CLI/tree/main/.agent/skills/api-security-best-practices commit 95146431b7

Frequently asked questions

npx skillmds@latest add dokhacgiakhoa/api-security-best-practices