Design and Build Great Web APIs

Chapter 10Securing APIs

In this chapter, we learn how to secure your API. API security consists of three key elements: identity, access control, and encryption. We’ll explore each one in turn and then focus on a solution for implementing each of them in a direct way.

After we review the security basics, we’ll dive into implementing them via standards called OpenAuth (OAuth)^[76] and JSON Web Token (JWT).^[77] OAuth is a protocol for requesting and sharing access control information for a particular user or machine. JWT is a standard way of representing access control in the form of a token. When used together, you can easily add security features ...