# api-security-best-practices

Guides API hardening across REST, GraphQL, and WebSockets. Sets up token authentication, input validation schemas, and rate throttling.

- skill · `type=skill` · Claude Code · 1739 installs
- Author: davila7
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/davila7/claude-code-templates/tree/HEAD/cli-tool/components/skills/security/api-security-best-practices
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/skills/api-security-best-practices

## What it does

This skill guides developers through securing endpoints across REST, GraphQL, and WebSocket architectures. It structures safeguards around five stages: credential handling, request sanitization, traffic throttling, data encryption, and vulnerability verification based on the OWASP API Top 10.

During code generation, Claude sets up token workflows such as JWT with refresh tokens, session stores, or role-based access control. Input schemas and parameterized statements prevent injection flaws like SQLi or cross-site scripting. Without environment variables configured for token signing secrets, the generated authentication middleware will fail at startup.

## Install

### Claude Code (native platform)

1. **claude-code-templates**
```bash
npx claude-code-templates@latest --skill security/api-security-best-practices
```

2. **Skills CLI (Vercel)**
```bash
npx skills add davila7/claude-code-templates --skill api-security-best-practices -a claude-code
```

3. **Manually: put the files in place**
- File: `~/.claude/skills/api-security-best-practices/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/api-security-best-practices/

### Codex

**Manually: put the files in place**
- File: `.agents/skills/api-security-best-practices/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

**Manually: put the files in place**
- File: `.cursor/skills/api-security-best-practices/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install davila7/claude-code-templates api-security-best-practices
```

2. **Manually: put the files in place**
- File: `.github/skills/api-security-best-practices/SKILL.md`

### Gemini CLI

**Platform CLI**
```bash
gemini skills install https://github.com/davila7/claude-code-templates --path cli-tool/components/skills/security/api-security-best-practices
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/api-security-best-practices/SKILL.md` — The legacy .windsurf/skills/ path still works

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/davila7/claude-code-templates/tree/HEAD/cli-tool/components/skills/security/api-security-best-practices

## When to use it
- implement JWT authentication with role-based access controls
- sanitize request payloads to block injection flaws
- throttle incoming traffic per IP address to prevent abuse
- prevent sensitive field leaks in server error payloads

## Example prompts
- Audit the endpoints in `routes/api.js` against the OWASP API Top 10
- Create an Express middleware for JWT validation with token refresh
- Configure rate limits and request quotas on the authentication routes

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

From the same set: [davila7/claude-code-templates](https://affpapa.org/en/nevibecode/by/davila7/claude-code-templates.md) — 495 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md