skills.rest
calcosmic
calcosmicCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

api-security

Enforce API security controls for authentication, authorization, and rate limiting.

9|1|Updated Feb 1, 2026
Search Tags:#authorization#jwt#api-security#rate-limiting#oauth2#threat-protection
One-click install
npx skills add https://github.com/calcosmic/Aether --skill api-security-calcosmic
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: api-security
Source: https://github.com/calcosmic/Aether/tree/main/.aether/skills-codex/domain/api-security
Command: npx skills add https://github.com/calcosmic/Aether --skill api-security-calcosmic

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

APIs frequently face unauthorized access, token misuse, and misconfigurations that expose data and degrade reliability. This Skill provides a practical blueprint for implementing authentication, authorization, rate limiting, and threat protection across modern API stacks.

Core Features & Use Cases

  • OAuth2 and OpenID Connect best practices: use Authorization Code Flow with PKCE for public clients, validate tokens server-side, and rotate tokens to minimize risk.
  • JWT and token management: include essential claims, use asymmetric signing when verifying across services, and enforce expirations and revocation strategies.
  • Security headers and rate limiting: apply appropriate headers, enable strict transport security, and implement per-endpoint throttling to prevent abuse.
  • Use Case: Secure a suite of microservices behind an API gateway with consistent auth, RBAC, and audit-friendly policies.

Quick Start

Configure your API project to require OAuth2 with PKCE, validate tokens on every request, and apply rate limiting.

Frequently Asked Questions about api-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I secure API endpoints with OAuth2 and JWT token validation?▼

To secure API endpoints with OAuth2 and JWT, implement the Authorization Code Flow with PKCE for public clients, include essential claims in tokens, and validate tokens server-side on every request using asymmetric signing.

What is the best way to implement rate limiting and threat protection for microservices?▼

The best way to implement rate limiting and threat protection for microservices is applying per-endpoint throttling, strict transport security, and appropriate security headers consistently behind an API gateway.

How do I configure authorization and RBAC policies for an API gateway?▼

Configure authorization and RBAC policies for an API gateway by enforcing consistent auth, applying audit-friendly policies, and validating tokens across services to manage user data access securely.

How does JWT token revocation and expiration work across backend services?▼

JWT token revocation and expiration works across backend services by using asymmetric signing for verification and enforcing strict expiration timelines and revocation strategies to minimize token misuse risk.

Do I need OpenID Connect to handle authentication for public API clients?▼

Yes, you need OpenID Connect for public API clients to apply best practices like the Authorization Code Flow with PKCE, ensuring robust authentication and server-side token validation.

Why does API security require environment files and auth configurations?▼

API security requires environment files and auth configurations to properly detect and package common security artifacts, ensuring backend services and API gateways handling user data enforce necessary access controls.

Related Skills

Explore More Software Engineering Skills→
vlad-ryzhkovvlad-ryzhkov
25

repo-scout

Audit Go backend repositories for API endpoints, infrastructure, and test coverage.

Community
Intermediate
genesis-agentsgenesis-agents
2

Security Specialist

Implement JWT authentication, RBAC authorization, and rate limiting for APIs.

Community
Advanced
mahg-esmahg-es
3

api-gateway

Design and configure API gateways for routing, authentication, and traffic management.

Official
Advanced
PriyanshKuniyalPriyanshKuniyal

auth-implementation-patterns

Implement JWT, OAuth2, and session-based authentication for APIs.

Community
Advanced