Daniel W.
Sample Webhook verification done right
Signature, timestamp, idempotency and fast response. Exactly the checklist I needed.
API security for developers: OAuth 2.0, JWT and rate limits
Design and build APIs that authenticate correctly, authorise every object, validate input, limit abuse and stay inventoried, guided by the OWASP API Top 10
Created by Jonas Lindqvist
- Updated September 2026
- English
- Intermediate
What you will learn
- Enforce object and function level authorisation in every API handler
- Validate OAuth 2.0 access tokens and JWTs correctly
- Prevent mass assignment and excessive data exposure with explicit schemas
- Apply rate limits and quotas that protect resources and business flows
- Consume third party APIs and webhooks safely
- Maintain an API inventory with versioning, documentation and security logging
Course content
API security foundations
Input, output and data exposure
- Video: Schema validation for every request 10 min
- Video: Preventing mass assignment 9 min
- Article: Response shaping and excessive data exposure 9 min
- Video: Pagination, filtering and query limits 9 min
Abuse and resource protection
- Video: Rate limiting strategies 11 min
- Article: Quotas and expensive operations 9 min
- Video: Protecting sensitive business flows 10 min
- Video: Idempotency and replay protection 9 min
Calling other systems safely
- Article: Consuming third party APIs safely 10 min
- Video: Verifying incoming webhooks 10 min
- Video: Preventing server side request forgery 10 min
GraphQL and gRPC notes
- Article: GraphQL specific risks 10 min
- Video: gRPC and service to service calls 9 min
- Video: API gateways and where they help 8 min
Operating secure APIs
- Article: API inventory and versioning 9 min
- Video: Security logging for APIs 9 min
- Video: Security testing in CI 10 min
- Article: An API security review checklist 8 min
- Quiz: Final check 6 min
Requirements
- Experience building REST APIs in any language
- Basic understanding of HTTP, JSON and authentication concepts
Description
APIs now carry most application traffic, and they fail in their own particular ways. An API that returns another customer's order when you change an id, accepts a role field it should ignore, or lets one client exhaust the database is not unusual. The OWASP API Security Top 10 exists because these problems are common.
What you will learn
- Object and function level authorisation, the two most common API flaws
- OAuth 2.0 and OpenID Connect from the API's point of view: scopes, audiences and token validation
- JWTs: what they are, how to validate them and the mistakes to avoid
- Input validation with schemas and protection against mass assignment
- Rate limiting, quotas and protection of sensitive business flows
- Safe consumption of third party APIs and webhooks
- API inventory, versioning and logging that supports investigations
How the course works
We secure a sample REST API for a project management product, written in Python with FastAPI and in TypeScript with Express. Each lesson adds a defence and an automated test that proves it works. The same principles apply to GraphQL and gRPC, and I point out the specific differences where they matter.
You should be comfortable building HTTP APIs. No prior security specialism is needed.
Who this course is for
- Backend and API developers
- Tech leads designing public or partner APIs
- Security champions reviewing API changes
Instructor
Jonas Lindqvist
Application security engineer helping developers write, review and test secure code
- 4.3 instructor rating
- 28 reviews
- 7,320 students
- 4 courses
- Sample
I sit between development and security teams, reviewing code, tuning scanners and teaching developers how common vulnerabilities actually appear in real code bases.
My courses are written for developers first. We read vulnerable code, exploit it in a safe lab, fix it and add a test or rule so it stays fixed. Examples use Python, JavaScript and Java because that is what most teams I meet write.
I focus on the OWASP Top 10, API security, authentication, and tooling such as Semgrep, CodeQL and secret scanners. My aim is that security becomes part of your normal review, not a separate step at the end.
Student reviews
Silvia G.
Sample BOLA explained with real code
Resolving access through the caller in the query itself changed how we write every handler.
Haruto K.
Sample Token validation finally clear
We were not checking the audience claim. Fixed the same day, with the four rejection tests from the JWT lesson.
Farah N.
Sample Clear rate limiting guidance
Token bucket explanation and Redis setup were very practical for our multi instance API.
Amelia P.
Sample Practical and well tested
Every defence comes with a test, which made it easy to bring into our codebase. GraphQL section was short.
Omar S.
Sample Mass assignment lesson was useful
Separating input models from database models closed a hole we did not know we had.
Ivana R.
Sample Good, Python and TypeScript only
Accurate and useful, but our services are in Go so I had to translate examples.
Keep exploring
All Secure Development courses
More in Secure Development
$59.99
Enroll now