Explain like I'm five · Security

What is API Security?

API security, told as a story about putting a doorkeeper on the small door behind the counter that only runners use.

other castleone loaf, pleasefrom the bakery castle, flour pleasea visitorthe counterthe runners' dooranother castle's runnerbehind the counter is a small door just for runners

Behind the counter is a small door that only runners use.Visitors come to the counter. But runners from other castles skip the counter and pick things up at the small door. That small door is the runners' door.

no doorkeepertakes the whole rosterBANGBANGBANGBANGknocks ten thousand times a dayand nobody countsa forgotten old doornobody remembers it's therethe counter has a checker — the back door has no one

Trouble starts when that door has no doorkeeper.A thief takes the whole roster, and nobody counts the ten thousand knocks. A forgotten old door? Nobody even remembers it. The counter has a checker — the back door has no one.

TICKETticketBACK-DOOR RULES1. check the ticket2. open only their own box3. count the knocks4. keep a list of doorsrunnerdoorkeeperput a doorkeeper on the back door too — as careful as the countercheck the ticket, open only their own box, count the knocks

API security is putting a doorkeeper on the runners' door.As careful as the counter. Check the ticket, let them open only their own box, count the knocks, and write down every door.

Check the ticketwho they are, what they may do
Only their own boxnever the one next to it
Count the knocksat a thousand, a break
A list of doorsso none is forgotten
box 7! …and box 8 too7, yes. 8, no.#6#7#8#9TICKETbakery castlebox 7 onlyknocks today: 998at 1000, take a breakrunnerdoorkeeperthe box shelfonly the box on the ticket — never the one next to it, even with a key

Only the box on the ticket opens. Not the one next to it.Even with an entry ticket, the box next door must stay shut. The doorkeeper also counts the knocks — at a thousand, it's time for a break.

OUR DOORScounter — checker ✓runners' door — doorkeeper ✓old back door — boarded ✓every door, written downdoorkeeperold door boardedno door to slip throughwhen every door has a name and a keeper, the thief finds no back way incount the doors from outside too, so none is forgotten

When every door has a name and a keeper, the thief finds no back way in.Also count the doors from outside, so none is forgotten. The runners' ticket is the ticket instead of a key story; the counter's checker is the note checker story.

In one breath

API security = put a doorkeeper on the small runners' door behind the counter too — one who checks the ticket, opens only their own box, counts the knocks, and keeps a list of doors.

Protecting the channels (APIs) that programs use to exchange data behind the screen. Authentication and authorization, object-level permissions (BOLA), rate limiting, and an API inventory are the core, and the OWASP API Top 10 is the standard checklist.

When grown-ups say it

API
The runners' door. Not the counter people use — the small door where programs hand things to each other.
Authentication · authorization
Who you are · what you may do. Both are written on the ticket. → a ticket instead of a key
BOLA
Opening the box next door. The ticket is real, but visitor 7 opens box 8 too. The most common back-door mistake.
Rate limiting
Counting the knocks. At a thousand, a break. It also holds off a fake crowd. → the fake crowd at the gate
API gateway
Where the doorkeeper stands. Gathers the runners' doors in one place, so tickets and knock counts are handled together.
API key
The runner's key. Lose it, and anyone becomes a runner. Never write it on a note; keep it in the vault. → keeping secret keys
OWASP API Top 10
Ten back-door mistakes. Opening the box next door is number one. The list the doorkeeper memorizes.
Shadow API
The forgotten old door. Nobody remembers it, but it's open. → counting our doors from outside
Next story
Crates from the Same Mold →
Want another term as a picture book? Request →