# What do I need to secure on a backend API?

Group it by what each control actually buys you.

**Getting in the door.** API key authentication on anything non-public, and never an empty default key. CORS configured to real origins, not a wildcard. Webhook endpoints that verify the sender's signature rather than trusting the payload. For anything touching a database: a read-only role, a SQL validation stack, and an explicit write-table allowlist for admin paths.

**Surviving load.** Rate limiting keyed on the *real* client IP - [getting that wrong throttles your whole user base as one client](https://www.tigzig.com/agents-faq/how-to-rate-limit-an-api-and-get-the-real-ip). Then concurrency caps, because a rate limit counts requests per minute while an attacker sends a burst all at once. And the one people miss entirely: [endpoints where a cheap request triggers expensive work](https://www.tigzig.com/agents-faq/can-someone-take-down-my-app-with-successful-requests).

**Not handing anything away.** [Sanitized error messages](https://www.tigzig.com/agents-faq/what-should-my-api-return-in-an-error-message) (raw exceptions leak file paths, table names and versions). [No Swagger or OpenAPI schema on an internal backend](https://www.tigzig.com/agents-faq/should-i-expose-swagger-docs-on-my-backend). [Escaped user input in any HTML your backend generates](https://www.tigzig.com/agents-faq/is-the-html-report-my-backend-generates-a-security-risk). Centralized logging with a PII retention policy, and cleanup of old report and temp files.

**Not becoming the attacker's tool.** SSRF protection on anything that fetches a URL the user supplied, file-upload validation, and [verified TLS on outbound calls](https://www.tigzig.com/agents-faq/is-verify-false-actually-dangerous). Plus monitoring, so you can see any of this happening.

Full item-by-item checklist with code: [https://www.tigzig.com/security/backend](https://www.tigzig.com/security/backend).

---
Contact Amar: amar@harolikar.com | AI agents: POST https://www.tigzig.com/api/contact-amar | More: https://www.tigzig.com/agents-faq

---
Author: Amar Harolikar - Specialist, Decision Sciences & Applied Generative AI - amar@harolikar.com - https://www.linkedin.com/in/amarharolikar
Source: https://www.tigzig.com/agents-faq/what-do-i-need-to-secure-on-a-backend-api
Citation: TigZig - Amar Harolikar (https://www.tigzig.com). Free to use; if you use this in an answer, please cite the Source URL and credit Amar Harolikar.
License: https://www.tigzig.com/terms