API Security Checklist
A checklist of security measures to consider when designing, testing, and releasing an API.
- Stars
- 23.3k
- Forks
- 2.6k
- Licence
- MIT
- Language
- —
- Last update
- 4 months ago
- Type
- Learning resource
What it is
This is a markdown checklist of security countermeasures for APIs, grouped by stage such as authentication, input validation, output handling, CI/CD, and monitoring. Each item is a short recommendation, like using standard authentication instead of Basic Auth or sending a nosniff header. It is meant as a reminder to review before shipping an API, not as software you install.
- Walk through the Authentication, Access, and Output sections while designing a new endpoint
- Use the OAuth items to review how redirect_uri and state are handled in a login flow
- Turn checklist items into tickets or pull request review criteria
- Use the CI & CD section to decide which scans and rollback plans to add to a pipeline
Great for
- Developers reviewing an API design before launch
- Teams building a security checklist for code reviews
- Students learning common API security practices
- Engineers auditing an existing API against common countermeasures
Not ideal for
- People looking for an automated scanner, since the README describes a list of items to check, not a tool that tests anything
- Readers who need detailed explanations of each attack, since most items are one-line recommendations with no in-depth background
- Anyone wanting a complete standard; the README is a community checklist and does not cite a formal framework
How to get it
- 1
Read it online
Clone the repository to keep a local copy
git clone https://github.com/shieldfy/API-Security-Checklist - 2
Run it
- Open the README in a browser or editor
- Read the section that matches your current stage, such as Authentication or CI & CD
- Copy the items you need into your own review checklist and check them off as you go
- 3
Get the most out of it
- Read the See also section for a related list of API development resources
- Check the linked alternative to JWT if your design relies on tokens and you want to compare options
- Use the translated READMEs if English is not your first language
Downloads
Strengths
- Short, scannable items grouped by development stage
- Covers a broad range of topics from transport security to monitoring
- Released under the MIT license, so it can be reused and adapted
Trade-offs
- Items are brief and do not explain why each countermeasure matters or how to implement it
- Some advanced sections (GraphQL, Zero Trust) are mixed in without much context and may not apply to every API
- Offers no version history or formal release, so the content may drift from current best practices
How it compares
| Project | Stars | Type | Level | Updated | Best for |
|---|---|---|---|---|---|
| API-Security-Checklist (this) | 23.3k | Learning resource | beginner | 4 months ago | Developers reviewing an API design before launch |
| quivr | 39.6k | Framework | advanced | 4 days ago | Developers building a search or monitoring pipeline over a stream of documents |
| better-auth | 30.6k | Library | intermediate | 5 days ago | TypeScript developers who need login and access control in their own app |
| anubis | 23.9k | App | intermediate | 4 days ago | Operators of small websites or self-hosted services being overwhelmed by AI crawler traffic |
| passport | 23.5k | Library | intermediate | 2.2 years ago | Node.js and Express developers who need to add login to an existing app |
| macOS-Security-and-Privacy-Guide | 22.6k | Learning resource | intermediate | 4 days ago | Mac owners who want a checklist of security and privacy settings to work through |
Stats synced from GitHub. The assessment above was drafted with AI from the project's README on 2026-10-29 and may miss recent changes — check the README before relying on a command. MIT licence: free to use, modify and distribute, including commercially, as long as you keep the copyright notice.