Top ways to secure APIs from hackers
Tags: api, testing, devops
Published: 2022-10-25 15:30:16

Hackers are everywhere. To protect our data and server from hackers, the backend developers need to put some security measures by adding different authorization techniques. Today we’ll show you some of those techniques.

First of all, we need an API server. Thankfully, there are services like https://webhook.site, which lets you test APIs without needing to create a server. 

Now we're going to demonstrate some techniques to secure the server using [The Postman](https://www.postman.com) and [API Tester](https://apitester.org) (supports Android & iOS). 

**1. API Key**

In this technique, developers put a Key and a Value in either the headers or the query. Let's do it the header way. In postman, we select the Authorization type to API Key (1). Now write a Key(2) and a Value(3). Then press Send(4).

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/huagqz10wlwnqmy0jlps.png)


Now, if we look at the webhook page, we’ll see a new header key named somekey with the value somevalue.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/pwbkob5hsgbximr90c5f.png)


Now we’ll do the same thing using API Tester. First open the app, and click on the Create new request button. 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/jsayza2mhaotuanpeozh.png)


From here, click on GET. 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/d9nieufbwm9ardsnfdak.png)

Then add the webhook URL. 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5w9kv065wbq4l8yspqz4.png)


Then click on Add Header(1) and put the Key(2) and Value(3). Then click on send button(4) at the top-right corner.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/2oi8go834qt7ld9d1xje.png)

Now again, if we look at the webhook page, we’ll see a new header key named somekey with the value somevalue has been received.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ibxsl34ryk34bu0bl6ut.png)


**2. Bearer Token**

Select authorization type as Bearer token and put the value of token as somevalue and click send.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/eoq4p2eaaics7f3w6cr5.png)

In the webhook page, we’ll see in the headers that there’s a new key named authorization & the value is Bearer somevalue.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/adw3ttnrw2u1o4xyo8m5.png)


Now using the API Tester app, first add a new header key named Authorization, and the value would be Bearer somevalue and press send.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/jjd5hfsrzm6yf0m1wgzj.png)

On the webhook page, we’ll see the bearer token successfully sent via the API Tester app.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ad5k4483r4c5wgx7iowv.png)


**3. Basic Auth**

Select authorization type as Basic Auth and put the username and password. Then click send.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ywgkw02822bd201o9rxv.png)

If we look at the webhook page, we’ll see the username is sent as php-auth-user, and the password is sent as php-auth-pw. 

Now using the API Tester app, in the headers, create a new key with the name php-auth-user, then put the username as the value. Then create a new key with the name php-auth-pw and put the password as the value. Click on the send button.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/oeflebd8m7pf0qelsl86.png)

On the webhook page, we’ll see that the values are received.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/sldjjaqbq0a5xdwr0a3p.png)


**4. No Auth**

What if there are no authorization techniques implemented? We can mimic this API behavior in the postman by selecting the no auth option and just clicking on the send button.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/hwdy8gsk4dhlahx3di7z.png)

And in the API Tester app, remove all the headers by clicking on the edit button.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/csa29tsc71c0lez7ha2e.png)


Then it’ll show the headers. Remove all the texts from here and press the cross button at the top-right corner.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ghvp1httydhk933azgs2.png)


Then just click on the sent button. As you can see on the webhook page, it shows the request headers without any new keys or values. 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/z2yycus08ucrgp9npgh7.png)


Now, if you are like me, who likes to work smart instead of working hard, you can simply export the APIs from Postman to the API Tester app by simply clicking on this button shown below.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/752kjco4wxelsqf3opu2.png)

Then select cURL and copy the texts below.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/883m2w3484xxjr5btea9.png)


Then in the API Tester app, while creating a new request, click on the cURL button.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/23z160fjdr7xh5q1s3yy.png)


Then paste the texts copied from the postman and click on import.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/76byqll97gejqxogcq0t.png)

And voila! You have added a new request using the exported cURL texts.


Give the [API Tester](https://apitester.org) a try. It's free and supports Android & iOS.