API Security Checklist: Protecting Your Endpoints in 2026

January 10, 2026 • 5 min read

---

APIs are the backbone of modern applications. They're also the most common attack vector. Here's what every API should implement before going to production.

Authentication

✅ Use JWT tokens with short expiration

Token lifetime: 2 hours max
Refresh tokens: 7 days, single-use

✅ Implement proper password hashing

// Use bcrypt with cost factor 12+
hash, _ := bcrypt.GenerateFromPassword([]byte(password), 12)

✅ Require strong passwords

• Minimum 12 characters
• Check against known breached passwords
• No password expiration (NIST guidelines)

Rate Limiting

✅ Limit by IP and by user

Anonymous: 20 requests/minute
Authenticated: 100 requests/minute
Per-endpoint limits for sensitive operations

✅ Implement exponential backoff for failures

1st failure: 1 second delay
2nd failure: 2 second delay
3rd failure: 4 second delay
5th failure: 15 minute lockout

Input Validation

✅ Validate everything

// Check length
if len(input) > 10000 {
    return ErrInputTooLarge
}

// Check format
if !isValidEmail(input.Email) {
    return ErrInvalidEmail
}

// Sanitize paths
if strings.Contains(slug, "..") {
    return ErrInvalidPath
}

✅ Use parameterized queries

// Never do this
query := "SELECT * FROM users WHERE id = " + userID

// Always do this
db.Query("SELECT * FROM users WHERE id = ?", userID)

Headers

✅ Set security headers

X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-XSS-Protection: 1; mode=block
Content-Security-Policy: default-src 'self'
Strict-Transport-Security: max-age=31536000

✅ Configure CORS properly

// Don't allow all origins in production
AllowedOrigins: []string{"https://yourdomain.com"}
AllowedMethods: []string{"GET", "POST", "PUT", "DELETE"}
AllowCredentials: true

Secrets Management

✅ Never commit secrets to git

# .gitignore
.env
*.key
*.pem

✅ Use environment variables

jwtSecret := os.Getenv("JWT_SECRET")
if jwtSecret == "" {
    log.Fatal("JWT_SECRET not set")
}

✅ Rotate secrets regularly

• JWT secrets: quarterly
• API keys: annually or on personnel changes
• Passwords: on suspected compromise

Logging

✅ Log security events

• Failed authentication attempts
• Rate limit violations
• Invalid tokens
• Unusual access patterns

✅ Don't log sensitive data

// Bad
log.Printf("Login attempt: user=%s password=%s", user, password)

// Good
log.Printf("Login attempt: user=%s success=%v", user, success)

Monitoring

✅ Alert on anomalies

• Spike in failed logins
• Unusual geographic access
• High error rates
• Latency increases

✅ Have an incident response plan

• Who gets notified?
• How do you revoke compromised tokens?
• What's your communication plan?

The Checklist

[ ] JWT authentication with 2-hour expiration
[ ] bcrypt password hashing (cost 12+)
[ ] Rate limiting (per-IP and per-user)
[ ] Brute force protection (lockout after 5 failures)
[ ] Input validation on all endpoints
[ ] Parameterized database queries
[ ] Security headers configured
[ ] CORS restricted to known origins
[ ] Secrets in environment variables
[ ] Sensitive data redacted from logs
[ ] Security event monitoring
[ ] Incident response plan documented

---

Privacy Firewall implements all of these security measures. See our security architecture for details.