The Nuts and Bolts of API Security: Protecting Your Data at All Times

on YouTube ↗27m

" summary

Claims that API keys are insufficient and that OAuth 2.0 plus OpenID Connect are the practical foundation for real API identity and delegation. Describes the four OAuth actors, the web‑server (authorization code) flow, and token types: access and refresh tokens, bearer vs holder‑of‑key and JWTs as compact by‑value tokens versus opaque by‑reference tokens. Recommends an API gateway that validates tokens at the edge and translates references into by‑value JWTs for internal microservices (at scale: many microservices per day).

AI-written summary · about

" chapters (6)

1. 0:00Intro
2. 0:30What are API keys
3. 5:25OAuth 2 Overview
4. 13:15JSON Web Tokens
5. 14:50OAuth Tokens
6. 23:17Microservices

" related talks

• 39mSecure your APIs using OAuth2 and OpenID ConnectTravis Spencer · Oredev 2017
• 20mBuilding a secure API: Overview of techniques and technologies needed to launch a secure APITravis Spencer · Nordic APIs Stockholm Spring 2013
• 29mFireside Chat About OAuth 2.0Aaron Parecki, Eric Johnson · GOTOpia February 2021
• 47mIntroduction to OAuth 2.0 and OpenID ConnectPhilippe De Ryck · GOTO Berlin 2018
• 19mIdentity:The missing link in API securityDavid Gorton · Platform Summit 2014
• 18mAPI Security Simplified: A 5-Pillar ApproachDavid Vazquez Cortizo · apidays London 2023
• 56mSecuring an API Ecosystem with OAuth 2 0Philippe De Ryck · OWASP 2022 Global AppSec Europe Virtual Event
• 32mSecuring Value in API EcosystemsAjay Biyani · apidays Singapore 2019