API security is the practice of protecting application programming interfaces (APIs) (the connections through which applications, services, and partners exchange data and functionality) from attacks, abuse, and unauthorized access. As APIs have become the backbone of modern applications, open banking, and integrations, they’ve also become a primary attack surface, making API security a critical discipline with identity at its core.

APIs expose data and functionality programmatically, which is enormously powerful and enormously attractive to attackers. Every API is a potential door into an application’s data and logic.

Why APIs are a major attack surface

APIs have proliferated (modern apps, microservices, mobile backends, and open-banking ecosystems run on them) and each is a potential target. They often expose sensitive data and operations directly, they can be probed and automated against at scale, and they’re frequently under-secured relative to user-facing interfaces. Attacks on APIs have surged as a result, and API vulnerabilities regularly lead to major data breaches.

The main API threats

• Broken authentication: weak or missing verification of who is calling the API.
• Broken authorization (BOLA/BFLA): the top API risk, failing to check that the caller is entitled to the specific object or function requested, letting attackers access others’ data by changing an ID.
• Excessive data exposure: APIs returning more data than needed, which attackers harvest.
• Abuse and automation: bots hitting APIs for scraping, credential stuffing, or enumeration.
• Injection and other classic web vulnerabilities adapted to APIs.

Industry guidance (like the OWASP API Security Top 10) consistently puts authorization failures at the top.

Why API security is identity-first

The most damaging API vulnerabilities are authentication and authorization failures, which means API security is, fundamentally, an identity problem. Properly authenticating every API caller (whether a user, a service, or an AI agent) and enforcing fine-grained authorization on every request (checking entitlement to the specific object or action) prevents the broken-authorization flaws that dominate API breaches. This is why an identity-first approach to API security (strong authentication, token-based authorization done correctly, and fine-grained per-request authorization) is essential rather than optional. Securing the network around APIs isn’t enough if any authenticated caller can access any object.

Securing APIs

Effective API security layers several controls: strong authentication (OAuth 2.0/OIDC done correctly, phishing-resistant where users are involved), fine-grained authorization enforced server-side on every request, token security (short-lived, properly scoped, validated), rate limiting and bot detection to stop abuse and automation, minimizing data exposure, and monitoring for anomalous API activity. As non-human identities and AI agents increasingly call APIs, authenticating and tightly scoping those callers becomes part of API security too. Treating APIs as core, identity-governed surfaces (not afterthoughts behind the "real" app) is the shift modern API security requires.

Frequently asked questions

What is API security?

Protecting APIs (the programmatic connections between applications and services) from attacks, abuse, and unauthorized access.

Why are APIs a major attack surface?

They’ve proliferated, expose sensitive data and operations directly, can be automated against at scale, and are often under-secured.

What’s the top API security risk?

Broken authorization (like BOLA), failing to check the caller is entitled to the specific object or function requested.

Why is API security identity-first?

The most damaging API flaws are authentication and authorization failures, so strong auth and fine-grained per-request authorization are the core defense.

Related: Authorization · Fine-Grained Authorization (FGA) · OAuth 2.0 · Token-Based Authorization (JWT) · Bot Detection · Open Banking