WEBVTT 00:00.000 --> 00:03.680 APIs share sensitive data so they must be protected. 00:03.680 --> 00:09.040 In this lesson, you'll quickly learn how developers secure APIs and tests safe requests 00:09.040 --> 00:11.200 as we explore securing APIs. 00:13.440 --> 00:14.720 Why security matters? 00:15.440 --> 00:18.640 In the world of APIs, security is extremely important. 00:19.120 --> 00:22.960 APIs often handle sensitive information such as personal data, 00:22.960 --> 00:25.280 financial records, or log-in details. 00:26.000 --> 00:30.480 If APIs are not secured properly, unauthorized users could access, 00:30.480 --> 00:32.800 steal, or modify this information. 00:33.520 --> 00:38.160 For example, imagine an API that returns student marks or bank details. 00:38.960 --> 00:43.920 If it is not protected, anyone could send a request and access confidential information. 00:44.880 --> 00:49.280 API security helps prevent unauthorized data access. 00:50.000 --> 00:52.400 Accidental or intentional data modification. 00:53.200 --> 00:54.960 Misuse of private information. 00:56.240 --> 01:01.120 That's why understanding API security is essential for every developer and student learning 01:01.120 --> 01:02.960 to build real-world applications. 01:03.440 --> 01:08.000 One of the simplest ways to secure an API is by using API keys. 01:09.280 --> 01:13.760 A key is like a password that the client includes in the request header or URL. 01:14.640 --> 01:18.160 While keys are easy to use, their drawback is that they are static. 01:18.720 --> 01:20.800 If exposed, they can be misused. 01:21.520 --> 01:26.000 A more secure approach is using bearer tokens or JWT, 01:26.000 --> 01:29.760 Jason Webb tokens, with token-based authentication. 01:30.880 --> 01:33.680 The server issues a token after verifying the user. 01:34.640 --> 01:37.360 The client includes this token in each request. 01:38.480 --> 01:40.880 The server checks whether the token is valid. 01:41.920 --> 01:44.560 Tokens can expire and are harder to misuse. 01:45.360 --> 01:49.440 This is why most modern apps, such as Instagram or Google services, 01:49.520 --> 01:51.600 use token-based authentication. 01:51.600 --> 01:54.320 Another common method is basic authentication, 01:54.320 --> 01:59.040 where the client sends a username and password encoded over HTTPS. 02:00.160 --> 02:03.840 This is simple, but should only be used in secure controlled environments. 02:04.640 --> 02:08.960 A more advanced approach is OAuth, a system that allows delegated access. 02:09.680 --> 02:14.000 For example, when you log in to a new website using your Google account, 02:14.000 --> 02:16.000 that site never sees your password. 02:16.800 --> 02:19.680 Google provides an access token on your behalf. 02:19.680 --> 02:21.360 This is OAuth in action. 02:22.320 --> 02:27.840 OAuth is widely used for, social logins, third-party integrations, 02:27.840 --> 02:29.760 apps that access your data securely. 02:30.480 --> 02:33.600 Even though the concept may seem advanced, the idea is simple. 02:34.320 --> 02:39.760 OAuth allows limited controlled access without sharing passwords. 02:40.880 --> 02:44.800 Developers secure their APIs by adding middleware or interceptors. 02:45.360 --> 02:49.920 These components check whether a request contains a valid API key or token. 02:50.480 --> 02:56.080 If the request is missing authentication, the API returns 401 unauthorized. 02:56.640 --> 03:00.880 This process ensures only verified clients can access the data. 03:02.720 --> 03:04.800 Hackers cannot call endpoints directly. 03:06.880 --> 03:09.520 Invalid or expired tokens are rejected. 03:10.160 --> 03:11.840 Hands-on exercise. 03:11.840 --> 03:16.160 Students update a previously created API to require an API key. 03:16.160 --> 03:19.440 Then they test an authorized request. 03:19.440 --> 03:21.840 An unauthorized request. 03:21.840 --> 03:26.720 This helps students see how security works in real-time using tools like Postman. 03:26.720 --> 03:34.240 API security is essential because it protects data and ensures safe communication between applications. 03:35.040 --> 03:42.000 By learning about API keys, JWT tokens, basic auth, OAuth, and middleware-based protection, 03:42.000 --> 03:44.800 students gain the tools to secure their own APIs. 03:45.680 --> 03:50.640 Understanding these principles prepares students for building real-world applications safely 03:50.640 --> 03:51.520 and responsibly. 03:52.320 --> 03:56.000 Just like locking your home, securing an API is not optional. 03:56.480 --> 03:58.400 It's necessary.