Shipping Secure APIs: A Practical Checklist

The API vulnerabilities we find in code review haven't changed much in a decade they've just moved to new frameworks. Broken object-level authorization is still the single most common finding: an endpoint checks that a user is authenticated, but not that they're authorized to access this specific resource.

OAuth2 done properly means scoped tokens, short expiries, and refresh token rotation not a single long-lived API key shared across every client. Pair it with rate limiting per token, not just per IP, since a stolen token behind a shared corporate NAT shouldn't get a free pass.

Schema validation at the boundary catches a surprising share of production incidents before they become incidents. Validate every request body against a strict schema reject unknown fields, enforce types and lengths — before it reaches business logic. It's cheap insurance against both bugs and injection attempts.

Rate limiting, structured logging of auth decisions, and dependency scanning in CI round out the baseline. None of this is exotic; the mistakes we still see in 2026 are the same ones from 2016, just wearing a newer framework's clothing. A short, boring checklist enforced on every merge beats a brilliant security review that happens once a year.