Api Security Best Practices

The api-security-best-practices skill guides developers in building secure APIs by implementing authentication, authorization, input validation, rate limiting, and defenses against common vulnerabilities including injection attacks and DDoS. It serves developers designing new APIs or securing existing ones and addresses the problem of preventing unauthorized access, data breaches, and API attacks through structured security patterns for REST, GraphQL, and WebSocket APIs. The skill covers five core areas: authentication and authorization setup, input validation and sanitization, rate limiting and throttling, data protection, and security testing aligned with OWASP API Top 10 standards.

skills.sh installs: 7.9K
GitHub stars: 43.1K
last updated: Jul 14, 2026

View on GitHub

Install

$ npx -y skills add sickn33/antigravity-awesome-skills --skill api-security-best-practices --agent claude-code

Installs into .claude/skills of the current project.

Files

API Security Best Practices

Review the request boundary from caller identity through authorization, validated input, storage and observable response. Preserve the application's actual identity provider and data model rather than introducing a second authentication system.

When to Use

Use when adding a protected endpoint, reviewing object access, replacing permissive request parsing, or investigating an API abuse path. For a concrete defect, start with the failing route and its callers; do not deploy unrelated security infrastructure.

Inputs and prerequisites

Record the routes, caller/tenant model, identity provider, token contract, runtime and locked dependency versions, database schema, proxy topology and authorized test scope. Use synthetic identities in a test environment. Existing task authorization carries forward; production scans, account writes and message sends need their own authority. The Node examples below are integration sketches for Express, jsonwebtoken and Zod; application/database adapters are deliberately named rather than presented as a full runnable service. Confirm APIs against the installed versions before integrating.

SKILL.md on GitHub