Build Your Experience5 Tips for API security.

How many times have you had a company tell you that your password or other personal data has been compromised? Probably too many. Security is a real issue, and it can be very detrimental to a brand’s reputation and customer retention. Below are five tips for increasing security when using APIs to keep your data and your customer data secure and safe. At the end, we’ll discuss some other methods that 8x8 uses to stay secure.

1. Don’t store API keys in your code.

This may be the easiest method when you’re creating something quickly, but storing your API key in your source code is a bad idea. It makes it easier for it to be exposed and taken advantage of. For instance, if your code is stored on Github in a public repository, someone could just download it straight away. If it’s stored in a private repository, there is still risk if you integrate with any third party APIs. You don’t have complete control over those third party APIs and if they get hacked, then you may become vulnerable as well. There are many other better ways to store your API keys, such as in environment variables, in files outside your app’s source tree, or using encryption.

How many times have you had a company tell you that your password or other personal data has been compromised? Probably too many. Security is a real issue, and it can be very detrimental to a brand’s reputation and customer retention. Below are five tips for increasing security when using APIs to keep your data and your customer data secure and safe. At the end, we’ll discuss some other methods that 8x8 uses to stay secure.

1. Don’t store API keys in your code.

This may be the easiest method when you’re creating something quickly, but storing your API key in your source code is a bad idea. It makes it easier for it to be exposed and taken advantage of. For instance, if your code is stored on Github in a public repository, someone could just download it straight away. If it’s stored in a private repository, there is still risk if you integrate with any third party APIs. You don’t have complete control over those third party APIs and if they get hacked, then you may become vulnerable as well. There are many other better ways to store your API keys, such as in environment variables, in files outside your app’s source tree, or using encryption.

How many times have you had a company tell you that your password or other personal data has been compromised? Probably too many. Security is a real issue, and it can be very detrimental to a brand’s reputation and customer retention. Below are five tips for increasing security when using APIs to keep your data and your customer data secure and safe. At the end, we’ll discuss some other methods that 8x8 uses to stay secure.

1. Don’t store API keys in your code.

This may be the easiest method when you’re creating something quickly, but storing your API key in your source code is a bad idea. It makes it easier for it to be exposed and taken advantage of. For instance, if your code is stored on Github in a public repository, someone could just download it straight away. If it’s stored in a private repository, there is still risk if you integrate with any third party APIs. You don’t have complete control over those third party APIs and if they get hacked, then you may become vulnerable as well. There are many other better ways to store your API keys, such as in environment variables, in files outside your app’s source tree, or using encryption.

How many times have you had a company tell you that your password or other personal data has been compromised? Probably too many. Security is a real issue, and it can be very detrimental to a brand’s reputation and customer retention. Below are five tips for increasing security when using APIs to keep your data and your customer data secure and safe. At the end, we’ll discuss some other methods that 8x8 uses to stay secure.

1. Don’t store API keys in your code.

This may be the easiest method when you’re creating something quickly, but storing your API key in your source code is a bad idea. It makes it easier for it to be exposed and taken advantage of. For instance, if your code is stored on Github in a public repository, someone could just download it straight away. If it’s stored in a private repository, there is still risk if you integrate with any third party APIs. You don’t have complete control over those third party APIs and if they get hacked, then you may become vulnerable as well. There are many other better ways to store your API keys, such as in environment variables, in files outside your app’s source tree, or using encryption.

2. Check into your API provider’s security and compliance credentials.

Your application’s security is only as good as that of your API providers. If you’re serious about understanding their security (which you should be), then be sure to vet their security and compliance certifications. These external validations should offer some reassurance and can reduce your legal risk exposure. For instance, if you’re building a healthcare technology product, it may be important for your API provider to be HIPAA compliant.

3. Use rate limiting.

We’ve all heard of the consequences of a company being a recipient of a nasty denial of service attack. An important first step to reduce the risk of them is to limit the number of requests that can be made in a certain time window. If the rate limit is exceeded on your API, then block the API key sending the unrestrained requests. It’s best practice to return the HTTP 429 “Too Many Requests” response status code.

2. Check into your API provider’s security and compliance credentials.

Your application’s security is only as good as that of your API providers. If you’re serious about understanding their security (which you should be), then be sure to vet their security and compliance certifications. These external validations should offer some reassurance and can reduce your legal risk exposure. For instance, if you’re building a healthcare technology product, it may be important for your API provider to be HIPAA compliant.

3. Use rate limiting.

We’ve all heard of the consequences of a company being a recipient of a nasty denial of service attack. An important first step to reduce the risk of them is to limit the number of requests that can be made in a certain time window. If the rate limit is exceeded on your API, then block the API key sending the unrestrained requests. It’s best practice to return the HTTP 429 “Too Many Requests” response status code.

2. Check into your API provider’s security and compliance credentials.

Your application’s security is only as good as that of your API providers. If you’re serious about understanding their security (which you should be), then be sure to vet their security and compliance certifications. These external validations should offer some reassurance and can reduce your legal risk exposure. For instance, if you’re building a healthcare technology product, it may be important for your API provider to be HIPAA compliant.

3. Use rate limiting.

We’ve all heard of the consequences of a company being a recipient of a nasty denial of service attack. An important first step to reduce the risk of them is to limit the number of requests that can be made in a certain time window. If the rate limit is exceeded on your API, then block the API key sending the unrestrained requests. It’s best practice to return the HTTP 429 “Too Many Requests” response status code.

2. Check into your API provider’s security and compliance credentials.

Your application’s security is only as good as that of your API providers. If you’re serious about understanding their security (which you should be), then be sure to vet their security and compliance certifications. These external validations should offer some reassurance and can reduce your legal risk exposure. For instance, if you’re building a healthcare technology product, it may be important for your API provider to be HIPAA compliant.

3. Use rate limiting.

We’ve all heard of the consequences of a company being a recipient of a nasty denial of service attack. An important first step to reduce the risk of them is to limit the number of requests that can be made in a certain time window. If the rate limit is exceeded on your API, then block the API key sending the unrestrained requests. It’s best practice to return the HTTP 429 “Too Many Requests” response status code.

4. Make all requests use HTTPS/TLS encryption or IPSec connections.

HTTP requests are insecure. You don’t want any “man-in-the-middle” attacks or impersonations - it’s critical to ensure that the data sent has not been modified or tampered with. If your API provider does not offer a secure, encrypted method for use, it’s worth finding a new API provider.

5. Enable two-factor authentication.

Your API provider probably has a portal of some sort to do configuration, look at charts, and manage your account. If someone can get access to your login credentials to the portal, then they may be able to get direct access to your API key and/or your API configuration. You should ensure all employees are setting strong passwords or passphrases. Accounts become much more secure when two-factor authentication is enabled. Rather than trusting a user to make a strong, unique password, adding another layer of security greatly helps reduce your risk of getting compromised. A couple of common forms of two-factor authentication include SMS passcodes and authentication apps.

4. Make all requests use HTTPS/TLS encryption or IPSec connections.

HTTP requests are insecure. You don’t want any “man-in-the-middle” attacks or impersonations - it’s critical to ensure that the data sent has not been modified or tampered with. If your API provider does not offer a secure, encrypted method for use, it’s worth finding a new API provider.

5. Enable two-factor authentication.

Your API provider probably has a portal of some sort to do configuration, look at charts, and manage your account. If someone can get access to your login credentials to the portal, then they may be able to get direct access to your API key and/or your API configuration. You should ensure all employees are setting strong passwords or passphrases. Accounts become much more secure when two-factor authentication is enabled. Rather than trusting a user to make a strong, unique password, adding another layer of security greatly helps reduce your risk of getting compromised. A couple of common forms of two-factor authentication include SMS passcodes and authentication apps.

4. Make all requests use HTTPS/TLS encryption or IPSec connections.

HTTP requests are insecure. You don’t want any “man-in-the-middle” attacks or impersonations - it’s critical to ensure that the data sent has not been modified or tampered with. If your API provider does not offer a secure, encrypted method for use, it’s worth finding a new API provider.

5. Enable two-factor authentication.

Your API provider probably has a portal of some sort to do configuration, look at charts, and manage your account. If someone can get access to your login credentials to the portal, then they may be able to get direct access to your API key and/or your API configuration. You should ensure all employees are setting strong passwords or passphrases. Accounts become much more secure when two-factor authentication is enabled. Rather than trusting a user to make a strong, unique password, adding another layer of security greatly helps reduce your risk of getting compromised. A couple of common forms of two-factor authentication include SMS passcodes and authentication apps.

4. Make all requests use HTTPS/TLS encryption or IPSec connections.

HTTP requests are insecure. You don’t want any “man-in-the-middle” attacks or impersonations - it’s critical to ensure that the data sent has not been modified or tampered with. If your API provider does not offer a secure, encrypted method for use, it’s worth finding a new API provider.

5. Enable two-factor authentication.

Your API provider probably has a portal of some sort to do configuration, look at charts, and manage your account. If someone can get access to your login credentials to the portal, then they may be able to get direct access to your API key and/or your API configuration. You should ensure all employees are setting strong passwords or passphrases. Accounts become much more secure when two-factor authentication is enabled. Rather than trusting a user to make a strong, unique password, adding another layer of security greatly helps reduce your risk of getting compromised. A couple of common forms of two-factor authentication include SMS passcodes and authentication apps.

Security at 8x8:

From physical security to data at rest or in motion, 8x8 is committed to protecting customers using the highest levels of security and compliance policies and procedures, verified by third-party security and compliance certifications.

Scans happen on a continuous basis throughout our systems. We have a team of internal pen testers, and we bring in a major global pen testing firm to ethically hack our systems and APIs regularly.

We recognize the need to balance usability and security to best serve our customers. We rely on multiple vectors of risk analysis and input to accomplish that balance. One of our most critical risk intelligence vectors is our external tester and security community.

A core part of delivering on the promise of customer security is listening and responding to the larger security community. As an example, our average response time to confirm an issue from a security researcher and begin prioritizing the issue is around 1 hour. Our researcher community helps us keep our customers secure.

Security has been built in from the ground up across all of our products. For instance, with our embeddable video API, 8x8 Jitsi as a Service, end-to-end encryption and passwords are available for customers to use.

8x8 puts the security measures in place to ensure your SMS messages are reliably and securely delivered.

Security at 8x8:

From physical security to data at rest or in motion, 8x8 is committed to protecting customers using the highest levels of security and compliance policies and procedures, verified by third-party security and compliance certifications.

Scans happen on a continuous basis throughout our systems. We have a team of internal pen testers, and we bring in a major global pen testing firm to ethically hack our systems and APIs regularly.

We recognize the need to balance usability and security to best serve our customers. We rely on multiple vectors of risk analysis and input to accomplish that balance. One of our most critical risk intelligence vectors is our external tester and security community.

A core part of delivering on the promise of customer security is listening and responding to the larger security community. As an example, our average response time to confirm an issue from a security researcher and begin prioritizing the issue is around 1 hour. Our researcher community helps us keep our customers secure.

Security has been built in from the ground up across all of our products. For instance, with our embeddable video API, 8x8 Jitsi as a Service, end-to-end encryption and passwords are available for customers to use.

8x8 puts the security measures in place to ensure your SMS messages are reliably and securely delivered.

Security at 8x8:

From physical security to data at rest or in motion, 8x8 is committed to protecting customers using the highest levels of security and compliance policies and procedures, verified by third-party security and compliance certifications.

Scans happen on a continuous basis throughout our systems. We have a team of internal pen testers, and we bring in a major global pen testing firm to ethically hack our systems and APIs regularly.

We recognize the need to balance usability and security to best serve our customers. We rely on multiple vectors of risk analysis and input to accomplish that balance. One of our most critical risk intelligence vectors is our external tester and security community.

A core part of delivering on the promise of customer security is listening and responding to the larger security community. As an example, our average response time to confirm an issue from a security researcher and begin prioritizing the issue is around 1 hour. Our researcher community helps us keep our customers secure.

Security has been built in from the ground up across all of our products. For instance, with our embeddable video API, 8x8 Jitsi as a Service, end-to-end encryption and passwords are available for customers to use.

8x8 puts the security measures in place to ensure your SMS messages are reliably and securely delivered.

Security at 8x8:

From physical security to data at rest or in motion, 8x8 is committed to protecting customers using the highest levels of security and compliance policies and procedures, verified by third-party security and compliance certifications.

Scans happen on a continuous basis throughout our systems. We have a team of internal pen testers, and we bring in a major global pen testing firm to ethically hack our systems and APIs regularly.

We recognize the need to balance usability and security to best serve our customers. We rely on multiple vectors of risk analysis and input to accomplish that balance. One of our most critical risk intelligence vectors is our external tester and security community.

A core part of delivering on the promise of customer security is listening and responding to the larger security community. As an example, our average response time to confirm an issue from a security researcher and begin prioritizing the issue is around 1 hour. Our researcher community helps us keep our customers secure.

Security has been built in from the ground up across all of our products. For instance, with our embeddable video API, 8x8 Jitsi as a Service, end-to-end encryption and passwords are available for customers to use.

8x8 puts the security measures in place to ensure your SMS messages are reliably and securely delivered.

Chapter Eight Takeaways

Security is a real issue and it can be detrimental to a brand’s reputation and customer retention. To stay secure, you can use the following tips: Don’t store API keys in your code. Check into your API provider’s security and compliance credentials. Use rate limiting. Make all requests use HTTPS/ TLS encryption or IPSec connections. And enable two-factor authentication. In addition to these tips, work with a solution with a security-first approach, like 8x8.

Helpful Resources

Overview: Security for 8x8’s SMS API Platform

Tutorial: Learn how to use API for Mobile Verification Code Generation & Validation

Overview: Mobile Verification

Chapter Eight Takeaways

Security is a real issue and it can be detrimental to a brand’s reputation and customer retention. To stay secure, you can use the following tips: Don’t store API keys in your code. Check into your API provider’s security and compliance credentials. Use rate limiting. Make all requests use HTTPS/ TLS encryption or IPSec connections. And enable two-factor authentication. In addition to these tips, work with a solution with a security-first approach, like 8x8.

Helpful Resources

Overview: Security for 8x8’s SMS API Platform

Tutorial: Learn how to use API for Mobile Verification Code Generation & Validation

Overview: Mobile Verification

Chapter Eight Takeaways

Security is a real issue and it can be detrimental to a brand’s reputation and customer retention. To stay secure, you can use the following tips: Don’t store API keys in your code. Check into your API provider’s security and compliance credentials. Use rate limiting. Make all requests use HTTPS/ TLS encryption or IPSec connections. And enable two-factor authentication. In addition to these tips, work with a solution with a security-first approach, like 8x8.

Helpful Resources

Overview: Security for 8x8’s SMS API Platform

Tutorial: Learn how to use API for Mobile Verification Code Generation & Validation

Overview: Mobile Verification

Chapter Eight Takeaways

Security is a real issue and it can be detrimental to a brand’s reputation and customer retention. To stay secure, you can use the following tips: Don’t store API keys in your code. Check into your API provider’s security and compliance credentials. Use rate limiting. Make all requests use HTTPS/ TLS encryption or IPSec connections. And enable two-factor authentication. In addition to these tips, work with a solution with a security-first approach, like 8x8.