What is an API security best practice?

API security best practices: (1) Authentication: use OAuth 2.0/OpenID Connect; API keys for service-to-service. (2) Authorization: implement RBAC/ABAC; check object-level authorization on every request (prevent BOLA/IDOR). (3) HTTPS only: all API traffic must be encrypted. (4) Input validation: validate type, format, range, and length of all inputs; use an API schema (OpenAPI) for validation. (5) Rate limiting: prevent brute force and DoS. (6) No sensitive data in URLs: tokens, passwords, PII in query strings appear in logs and browser history. (7) Versioning: avoid breaking changes; maintain old versions. (8) Error handling: return generic errors — never expose stack traces, DB errors, or internal structure. (9) Logging and monitoring: log all API calls with user context. (10) Disable unused HTTP methods. (11) Security headers. (12) CORS policy: allowlist specific origins. (13) Dependency scanning: keep libraries updated. Reference: OWASP API Security Top 10.