API Security Best Practices

dokhacgiakhoa/api-security-best-practices

Implement secure API design patterns including authentication, authorization, input validation, rate limiting, and protection against common API vulnerabilities

6k tokens

context cost

the whole folder, loaded on every use

files

instructions only

copies elsewhere

how many repositories repackaged it

505

stars on the repo

on the repository, not the skill itself

Install

one command, takes just this skill from the repository

npx skills add https://github.com/Dokhacgiakhoa/Agent-Skills-4-Vibe-Coding-CLI --skill api-security-best-practices

What comes with it

22 361 bytes besides the instruction

sub-skills/advanced-per-user-rate-limiting.md

sub-skills/authentication-authorization.md

sub-skills/authentication-flow.md

sub-skills/data-protection.md

sub-skills/ddos-protection-with-helmet.md

sub-skills/do-this.md

sub-skills/dont-do-this.md

sub-skills/example-1-implementing-jwt-authentication.md

sub-skills/example-2-input-validation-and-sql-injection-prevention.md

sub-skills/example-3-rate-limiting-and-ddos-protection.md

sub-skills/implementation-with-express-rate-limit.md

sub-skills/implementation.md

sub-skills/input-validation.md

sub-skills/monitoring-logging.md

sub-skills/problem-jwt-secret-exposed-in-code.md

sub-skills/problem-missing-authorization-checks.md

sub-skills/problem-verbose-error-messages.md

sub-skills/problem-weak-password-requirements.md

sub-skills/rate-limit-response-headers.md

sub-skills/rate-limiting-ddos-protection.md

sub-skills/security-best-practices.md

sub-skills/step-1-authentication-authorization.md

sub-skills/step-2-input-validation-sanitization.md

sub-skills/step-3-rate-limiting-throttling.md

sub-skills/step-4-data-protection.md

sub-skills/step-5-api-security-testing.md

sub-skills/the-problem.md

sub-skills/the-solution.md

sub-skills/validation-checklist.md

sub-skills/why-rate-limiting.md

The instruction itself

35 sections, as written by the author

API Security Best Practices

Overview

Guide developers in building secure APIs by implementing authentication, authorization, input validation, rate limiting, and protection against common vulnerabilities. This skill covers security patterns for REST, GraphQL, and WebSocket APIs.

When to Use This Skill

Use when designing new API endpoints
Use when securing existing APIs
Use when implementing authentication and authorization
Use when protecting against API attacks (injection, DDoS, etc.)
Use when conducting API security reviews
Use when preparing for security audits
Use when implementing rate limiting and throttling
Use when handling sensitive data in APIs

How It Works

🧠 Knowledge Modules (Fractal Skills)

1. Step 1: Authentication & Authorization

2. Step 2: Input Validation & Sanitization

3. Step 3: Rate Limiting & Throttling

4. Step 4: Data Protection

5. Step 5: API Security Testing

6. Example 1: Implementing JWT Authentication

7. Authentication Flow

8. Implementation

9. Security Best Practices

10. Example 2: Input Validation and SQL Injection Prevention

11. The Problem

12. The Solution

13. Validation Checklist

14. Example 3: Rate Limiting and DDoS Protection

15. Why Rate Limiting?

16. Implementation with Express Rate Limit

17. Advanced: Per-User Rate Limiting

18. DDoS Protection with Helmet

19. Rate Limit Response Headers

20. ✅ Do This

21. ❌ Don't Do This

22. Problem: JWT Secret Exposed in Code

23. Problem: Weak Password Requirements

24. Problem: Missing Authorization Checks

25. Problem: Verbose Error Messages

26. Authentication & Authorization

27. Input Validation

28. Rate Limiting & DDoS Protection

29. Data Protection

30. Monitoring & Logging

How to use it

Copy the folder

Take dokhacgiakhoa/api-security-best-practices from the repository into ~/.claude/skills for personal use, or into .claude/skills inside a project.

Check the name does not clash

The agent identifies a skill by the name field in its header. Two skills with the same name cannot sit side by side — one of them will be ignored.