sec-api

Name: sec-api
Availability: InStock
Author: cyblow

Configure security headers, CORS, rate limiting, and JWT authentication for FastAPI services.

1|Updated Dec 22, 2025

Search Tags:#security #api #jwt #docker #rate-limiting #cors

Ready to run

npx skills add https://github.com/CybLow/pypaginate --skill sec-api

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: sec-api
Source: https://github.com/CybLow/pypaginate/tree/main/.opencode/skills/sec-api
Command: npx skills add https://github.com/CybLow/pypaginate --skill sec-api

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

API security best practices to harden endpoints, manage access, and reduce exposure across services.

Core Features & Use Cases

Security headers (CSP, HSTS, X-Frame-Options) to harden responses
CORS configuration and least-privilege allowlists for cross-origin requests
Rate limiting backends (Redis) to prevent abuse
JWT authentication flows with access and refresh tokens
API key management and rotation patterns
Container security and Dockerfile hardening for deployments

Quick Start

Implement the security headers middleware, configure CORS, and add JWT and API-key checks to secure your API endpoints.

Frequently Asked Questions about sec-api

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I implement security headers like CSP and HSTS for a FastAPI application?▼

To implement security headers like CSP and HSTS for a FastAPI application, apply a security headers middleware that injects Content-Security-Policy, Strict-Transport-Security, and X-Frame-Options into HTTP responses to harden endpoints.

What's the best way to configure CORS with a least-privilege allowlist for microservices?▼

The best way to configure CORS with a least-privilege allowlist for microservices is specifying strict origin allowlists in your framework configuration to manage cross-origin requests and reduce exposure across services.

How do I set up Redis-backed rate limiting to prevent API abuse?▼

You can set up Redis-backed rate limiting to prevent API abuse by configuring a rate limiting backend that tracks request counts per client identifier in Redis, blocking excessive requests before they reach endpoints.

Does this approach support JWT authentication flows with access and refresh tokens?▼

Yes, this approach supports JWT authentication flows with access and refresh tokens. It guides implementations of JWT workflows to establish access controls and manage secure authentication for web services and microservices.

How do I harden a Dockerfile for API container security during deployment?▼

To harden a Dockerfile for API container security during deployment, apply container security configurations that restrict permissions and isolate the environment, reducing exposure across services.

Can I use this security baseline with Starlette or do I need FastAPI?▼

You can use this security baseline with Starlette, as it applies to web services and microservices built with frameworks like FastAPI or Starlette, guiding implementations of authentication and rate limiting.