How Do You Secure Your REST API?
Key takeaways
- JWT validation must check the signature, the issuer, the audience and the expiry, and it must use a fixed algorithm list, because accepting the algorithm named in the token header is a classic token forgery path.
- OAuth 2.0 scopes should be narrow per endpoint, and an access token should live for minutes rather than days, so a leaked token has a short useful life.
- Authorise every object access on the server, because an endpoint that only checks the token still returns another user's record when the identifier in the path is changed.
- Rate limit by user and by IP across login, OTP, password reset and search, since unlimited attempts turn a weak credential into a compromise.
- Store secrets in a managed secret store or a vault, never in the repository, and rotate them, because a token committed to Git is usually still valid when it is found.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
How should I implement authentication for a REST API?
Use OAuth 2.0 with an authorisation code flow and PKCE for user-facing clients, and the client credentials flow for machine-to-machine calls between your own services. Issue access tokens as JWTs that expire in 10 to 15 minutes, and refresh tokens that are stored server-side, rotated on every use and revocable. Never put a long-lived API key in a mobile app, because the app binary is readable on the device. For third-party integrations, use signed requests with a timestamp and nonce so a captured request cannot be replayed. In every case, keep the credential out of the source repository: a secret manager, a vault, or an encrypted environment variable, with rotation scheduled.
What does proper JWT validation look like?
Four checks, every time, in code you own. Verify the signature against the issuer's public key, and pin the expected algorithm instead of trusting the alg field in the token header, because accepting HS256 with the public key as the shared secret is a known forgery path. Check that the issuer and the audience are the values you expect, which stops a token minted for a different service or a staging environment being replayed against production. Check expiry and not-before with a small clock-skew allowance, and reject a token whose lifetime exceeds the maximum you issued. On top of that, handle revocation for logout and for a compromised account, since a stateless token cannot be deleted on its own.
Which REST API controls stop account takeover and data leaks?
Rate limiting and authorisation matter most in production. Rate limit by user and by IP, with tighter limits on login, OTP, password reset and resend-verification routes, and return a generic failure message so the response does not reveal whether the account exists. Authorise at the object level on every request that touches a record, checking ownership in the query itself, and deny by default for anything the role map does not explicitly permit. Add strict CORS with an allowlist of your own origins, and a Content Security Policy on any HTML your API returns. Log every authentication failure, authorisation denial and unusual data volume with the user, source IP and request identifier.
| Control | Attack it stops | Implementation note |
|---|---|---|
| Short-lived access tokens with narrow scopes | Token theft abuse | 10 to 15 minute expiry, per-endpoint scopes |
| Strict JWT validation with pinned algorithm | Token forgery | Check signature, issuer, audience, expiry |
| Object-level authorisation in the query | Insecure direct object reference | Filter by owner in the database call |
| Deny by default on role permissions | Privilege escalation | Explicit allow-list per endpoint |
| Rate limiting by user and by IP | Credential stuffing, OTP bombing | Tighter limits on auth and OTP routes |
| Strict CORS allowlist and CSP | Cross-origin data theft | No wildcard origin with credentials |
| Security event logging and alerting | Undetected abuse | Log denials with user, IP and request id |
What are the frequently asked questions?
Get a straight answer on this
Send us your endpoint list and token flow, and we will return a REST API hardening checklist mapped to your current implementation.
Send us the details See pricing