skills.rest
htafolla
htafollaCOMMUNITY
Explore all skills by this author →
GitHub

api-security-best-practices

Implement secure API design patterns with authentication, validation, and rate limiting.

5|1|Updated Jan 7, 2026
Search Tags:#authorization#authentication#input validation#rate limiting#secure coding#api security
One-click install
npx skills add https://github.com/htafolla/StringRay --skill api-security-best-practices-htafolla
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: api-security-best-practices
Source: https://github.com/htafolla/StringRay/tree/main/ci-test-env/.opencode/integrations/api-security-best-practices
Command: npx skills add https://github.com/htafolla/StringRay --skill api-security-best-practices-htafolla

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps developers implement secure API design patterns, protecting against common vulnerabilities and ensuring data integrity.

Core Features & Use Cases

  • Authentication & Authorization: Guides implementation of secure methods like JWT and OAuth 2.0.
  • Input Validation & Sanitization: Prevents injection attacks (SQL, XSS) by validating and sanitizing all incoming data.
  • Rate Limiting & DDoS Protection: Implements mechanisms to prevent API abuse and ensure availability.
  • Data Protection: Ensures data is secured in transit and at rest.
  • Use Case: When developing a new user authentication API, use this Skill to ensure JWT tokens are securely generated, validated, and that refresh tokens are handled properly, while also implementing rate limiting to prevent brute-force attacks.

Quick Start

Use the api-security-best-practices skill to implement JWT authentication for a new API endpoint.

Frequently Asked Questions about api-security-best-practices

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I implement secure JWT authentication for a new REST API endpoint?▼

Secure JWT authentication requires properly generating and validating tokens, plus handling refresh tokens correctly. This approach implements secure token generation and refresh token management alongside rate limiting to prevent brute-force attacks.

What are the OWASP API Security Top 10 risks and how do I protect against them?▼

OWASP API Security Top 10 risks are common vulnerabilities across REST, GraphQL, and WebSocket protocols. Protection involves implementing secure coding patterns like input validation, sanitization, and robust authorization to prevent injection attacks and ensure data integrity.

What's the best way to prevent SQL injection and XSS attacks through API input validation?▼

Preventing SQL injection and XSS attacks through API input validation requires validating and sanitizing all incoming data. Implementing comprehensive input validation and sanitization mechanisms stops injection attacks before they reach backend systems.

How do I set up rate limiting and DDoS protection for my API?▼

Rate limiting and DDoS protection for APIs are implemented by adding mechanisms to prevent API abuse and ensure service availability. These mechanisms restrict excessive requests, protecting endpoints from brute-force attacks and distributed denial of service disruptions.

Does this secure API guidance apply to GraphQL and WebSocket protocols as well as REST?▼

Yes, this secure API guidance applies to GraphQL and WebSocket protocols as well as REST. It provides comprehensive design patterns and code examples for authentication, authorization, and vulnerability protection across all three communication protocols.

Related Skills

Explore More Software Engineering Skills→
darthlinuxerdarthlinuxer

api-patterns

Guide API architects in selecting architectures and defining response, versioning, and pagination strategies.

Community
Intermediate
sevenbelowllcsevenbelowllc

cloudflare

Manage Cloudflare DNS, WAF, firewall rules, and origin certificates via Terraform.

Official
Advanced
MichelMokbelMichelMokbel

security-audit

Scan software projects for CVEs, injection flaws, and hardcoded secrets.

Community
Advanced
jayantrohila57jayantrohila57

api-security-best-practices

Implement secure API design patterns for REST, GraphQL, and WebSocket APIs.

Community
Advanced