API Security Best Practices
Determine your weaknesses
Make use of a solid authentication and authorization solutions
Tokens should be used
Make use of a service mesh
Create a threat model
Don't reveal any more information than is absolutely essential