arainho/awesome-api-security

Awesome API Security is a curated reference list for anyone who works with APIs and wants to understand the security risks involved. An API (Application Programming Interface) is the way software systems communicate with each other over the internet. When an API is poorly secured, attackers can extract data they should not see, impersonate users, or bypass access controls entirely. This repository collects open-source tools, books, cheatsheets, training materials, and other resources that help developers and security professionals learn about and test API security. The list is organized into distinct sections. Some sections are aimed at defenders: cheatsheets from OWASP (a well-known security standards organization), books on building secure APIs, specifications for common authentication and authorization standards, and ready-made security checklists for REST and GraphQL APIs. Other sections are oriented toward testers and security researchers: tools for scanning APIs, wordlists for fuzzing (automated probing for weaknesses), deliberately vulnerable practice APIs to learn on, and guidance on finding and verifying leaked API keys in public code. There are also sections covering training labs, conference talks, podcasts, video playlists, and newsletters dedicated to API security, making the list useful both for someone starting to learn the topic and for experienced practitioners looking for specific tools or reading material. The project does not contain any code of its own. It is purely a maintained index of external links. Contributions are accepted via pull requests, and the focus is specifically on open-source or freely available resources rather than commercial products. The full README is longer than what was shown.