api-security

Implement secure API design patterns for REST, GraphQL, and WebSocket APIs.

7|2|Updated Jan 28, 2026

Search Tags:#authorization #authentication #input validation #rate limiting #owasp #api security

Ready to run

npx skills add https://github.com/LuisSambrano/antigravity-config --skill api-security-luissambrano

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: api-security
Source: https://github.com/LuisSambrano/antigravity-config/tree/main/skills/5-security/api-security
Command: npx skills add https://github.com/LuisSambrano/antigravity-config --skill api-security-luissambrano

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires jsonwebtoken, express-rate-limit, ioredis, helmet, zod, bcrypt, isomorphic-dompurify, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill addresses the critical need to secure APIs against common vulnerabilities, ensuring data integrity, user privacy, and system resilience.

Core Features & Use Cases

Authentication & Authorization: Implement secure methods like JWT and RBAC.
Input Validation & Sanitization: Prevent injection attacks (SQL, XSS) using tools like Zod.
Rate Limiting & DDoS Protection: Guard against abuse and attacks using libraries like express-rate-limit.
Data Protection: Ensure secure data transit (HTTPS) and at rest.
Use Case: Secure a new user registration API endpoint by implementing password hashing, email validation, and rate limiting to prevent brute-force attacks.

Quick Start

Use the api-security skill to implement JWT authentication and authorization for an Express.js API.

Frequently Asked Questions about api-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I implement JWT authentication and authorization in an Express.js API?▼

Implement JWT authentication in an Express.js API by using the jsonwebtoken library to generate and verify tokens. This Skill provides code examples and best practices for secure authentication and authorization.

What's the best way to prevent SQL injection and XSS attacks in Node.js APIs?▼

Prevent SQL injection and XSS attacks in Node.js APIs by applying input validation and sanitization. This Skill guides developers in using Zod for validation and isomorphic-dompurify for sanitization to block malicious inputs.

How do I add rate limiting to protect REST and GraphQL APIs from DDoS attacks?▼

Add rate limiting to protect REST and GraphQL APIs from DDoS attacks using the express-rate-limit library. This Skill provides code examples to configure rate limiting and guard against API abuse.

Does this API security guidance apply to WebSocket APIs or only REST endpoints?▼

This API security guidance applies to WebSocket APIs as well as REST and GraphQL endpoints. It covers authentication, authorization, input validation, and rate limiting across all three API protocols.

Can I use Zod and helmet together to secure a new user registration API endpoint?▼

Yes, you can use Zod and helmet together to secure a new user registration API endpoint. This Skill demonstrates combining password hashing, email validation, and rate limiting to prevent brute-force attacks.

Why do I need bcrypt and ioredis for secure API design patterns in Node.js?▼

You need bcrypt for secure password hashing and ioredis for managing rate limiting state in Node.js. These dependencies help implement robust authentication and protect APIs against brute-force attacks.