consolelog.tools

API Security Checklist

Track API security best practices — weighted score, per-category progress, search & filter, and Markdown/text export.

About this ToolHow it works, benefits & use cases

This interactive API Security Checklist walks through the practices that keep a production API safe, organised into eight categories: Authentication, Authorization, Input Validation, Encryption, API Design, Logging & Monitoring, Dependencies, and Testing. Each item carries a concrete description and example tactics — use bcrypt or Argon2, validate with Zod, whitelist CORS origins, set HSTS, prevent IDOR, and so on. As you tick items off, a weighted score updates: critical categories count three times as much as medium ones, so the number reflects real risk rather than a flat percentage. You get a security level (poor/fair/good/excellent), per-category progress bars, and targeted recommendations for the critical gaps that remain. Search and filter let you focus on remaining or completed items, and your progress is saved in the browser. Export the whole checklist as GitHub-flavoured Markdown task lists or plain text.

How to Use

  1. 1Read through the categories (collapse or expand any with its header) and tick the practices your API already implements.
  2. 2Watch the Security Level card update — the weighted score, completed/remaining counts and the colour-coded bar reflect critical-first weighting.
  3. 3Use the Search box and the Show filter (All / Remaining only / Completed only) to focus on what is left.
  4. 4Check the Recommendations panel for the critical categories that still have open items.
  5. 5Pick Markdown or Plain text in the Export format dropdown and click Export to download a shareable checklist; use Reset to clear progress.

Key Benefits

  • Weighted scoring that triples critical categories so the score tracks real exposure
  • Eight categories spanning auth, authorization, validation, encryption, design, logging, dependencies and testing
  • Per-category progress bars plus an overall security level (poor/fair/good/excellent)
  • Targeted recommendations that call out unfinished critical categories first
  • Search and a remaining/completed filter to triage a long list quickly
  • Concrete example tactics under each item (bcrypt, Zod, HSTS, IDOR checks, and more)
  • Markdown export renders as GitHub task lists; progress persists locally in your browser

Common Use Cases

  • Running a pre-launch security review of a new REST or GraphQL API
  • Producing a Markdown checklist to drop into a pull request or security ticket
  • Onboarding a team to baseline API security practices with worked examples
  • Tracking remediation progress over time as items get implemented
  • Auditing an existing service against OWASP-aligned categories and scoring the gaps
Security Levelpoor
0
Completed
31
Remaining
0
Score / 100

Recommendations

  • • CRITICAL: Complete Authentication checklist (5 items remaining)
  • • CRITICAL: Complete Authorization checklist (4 items remaining)
  • • CRITICAL: Complete Input Validation & Sanitization checklist (4 items remaining)
  • • CRITICAL: Complete Encryption & Data Protection checklist (3 items remaining)
  • • Perform regular security audits
  • • Stay updated on OWASP API Security Top 10
  • • Implement automated security testing in CI/CD

Implement OAuth 2.0, JWT, or API keys with proper validation

  • • Use OAuth 2.0 for third-party integrations
  • • Implement JWT with short expiration times
  • • Use refresh tokens for long-lived sessions

Require MFA for sensitive operations

  • • Use TOTP (Time-based One-Time Password)
  • • Support SMS or email verification
  • • Implement WebAuthn for hardware keys

Use headers or request body for sensitive data

  • • Use Authorization header for tokens
  • • Avoid query parameters for passwords
  • • Log URLs without sensitive data

Enforce strong passwords and use proper hashing

  • • Minimum 12 characters
  • • Use bcrypt, scrypt, or Argon2 for hashing
  • • Check against breached password databases

Sessions should expire and be revocable

  • • Set appropriate session timeouts
  • • Implement token revocation endpoint
  • • Clear sessions on logout

Define clear roles and permissions

  • • Use roles like admin, user, guest
  • • Check permissions on every request
  • • Implement least privilege principle

Never trust client-side authorization checks

  • • Verify user permissions in middleware
  • • Check resource ownership
  • • Validate against session data

Always verify resource ownership

  • • Check if user owns the resource
  • • Use UUIDs instead of sequential IDs
  • • Validate resource access permissions

Prevent abuse and protect resources

  • • Different limits for authenticated users
  • • Stricter limits for sensitive endpoints
  • • Monitor and adjust limits based on usage

Use schema validation for requests

  • • Use Joi, Zod, or Yup for validation
  • • Validate data types, formats, ranges
  • • Reject invalid requests early

Protect against SQL, NoSQL, and command injection

  • • Use parameterized queries
  • • Escape special characters
  • • Use ORM frameworks

Verify Content-Type header matches payload

  • • Reject unexpected content types
  • • Validate JSON structure
  • • Limit file upload types

Prevent DoS through large payloads

  • • Set max body size limits
  • • Limit file upload sizes
  • • Implement request timeouts

Encrypt all data in transit

  • • Use TLS 1.2 or higher
  • • Implement HSTS headers
  • • Use valid SSL certificates

Protect stored sensitive information

  • • Encrypt PII and passwords
  • • Use AES-256 for encryption
  • • Manage encryption keys securely

Avoid insecure protocols

  • • No HTTP for sensitive data
  • • Disable SSLv3, TLS 1.0, TLS 1.1
  • • Use perfect forward secrecy

Follow REST conventions for methods

  • • GET for reading (idempotent)
  • • POST for creating
  • • PUT/PATCH for updating
  • • DELETE for removing

Don't leak sensitive information in errors

  • • Use generic error messages
  • • Log detailed errors server-side
  • • Don't expose stack traces

Support multiple versions gracefully

  • • Use URL versioning (/v1/, /v2/)
  • • Or header-based versioning
  • • Deprecate old versions properly

Configure Cross-Origin Resource Sharing securely

  • • Whitelist specific origins
  • • Don't use wildcard (*) in production
  • • Validate Origin header

Implement security-related HTTP headers

  • • Content-Security-Policy
  • • X-Content-Type-Options: nosniff
  • • X-Frame-Options: DENY

Track authentication, authorization, and suspicious activity

  • • Failed login attempts
  • • Authorization failures
  • • Rate limit violations

Avoid logging passwords, tokens, or PII

  • • Mask passwords in logs
  • • Redact credit card numbers
  • • Hash or omit tokens

Monitor for anomalies and attacks

  • • Alert on unusual patterns
  • • Track error rates
  • • Monitor performance metrics

Track critical operations

  • • Log data modifications
  • • Track admin actions
  • • Record access to sensitive data

Regularly update libraries and frameworks

  • • Use npm audit or Snyk
  • • Enable Dependabot
  • • Review security advisories

Never hardcode secrets

  • • Use .env files (not in git)
  • • Use secret management tools
  • • Rotate secrets regularly

Scan code and dependencies for vulnerabilities

  • • SAST (Static Analysis)
  • • DAST (Dynamic Analysis)
  • • Container scanning

Regular penetration testing and security audits

  • • Manual penetration testing
  • • Automated security scans
  • • Bug bounty programs

Clear documentation for developers

  • • Authentication flow
  • • Authorization rules
  • • Rate limiting policies

Test boundary conditions and error cases

  • • Invalid input handling
  • • Large payload handling
  • • Concurrent requests

Was this tool helpful?

Share Your Experience

Help others discover this tool!

Share on Twitter

Related tools