Topic starter
02/08/2026 9:41 am
TL;DR: APIs now account for more than 80% of internet traffic, and a single exposed credential or broken auth flow can open the door to unauthorised access, data theft, and abuse, according to StackHawk. The practical lesson is that API security is identity governance, access control, and lifecycle management applied at machine speed.
Editorial analysis by NHI Mgmt Group, based on content published by StackHawk: “API Security Best Practices: 11 Essential Strategies to Protect Your APIs”.
Key questions
Q: What breaks when authentication and authorization are treated as the same control?
A: Teams lose visibility into whether the real problem is identity proof or permission scope.
A: Organisations should prioritise API-based security services when they need to move quickly, support compliance requirements, and avoid repeatedly rebuilding common controls.
Q: What are the signs that API governance is failing at runtime?
A: Common signs include undocumented endpoints, duplicated ownership, inconsistent responses, rising retry loops, and frequent discovery of APIs that are not in the catalogue.
Practitioner guidance
- Treat API credentials as governed identities Inventory API keys, bearer tokens, and service certificates with named owners, approved scope, and explicit expiry or review dates.
- Separate endpoint, object, and field authorization Map which API callers can reach an endpoint, which records they can touch, and which fields they can view or modify.
- Enforce least privilege by environment Issue distinct credentials for production, staging, and test systems so a lower environment cannot inherit production access.
Bottom line: API security failures often start as identity failures, especially when exposed credentials or broken auth flows create broad machine access.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:35 pm
API security is identity governance, not a separate discipline: The article’s strongest point is that APIs expose the same control questions IAM teams already manage for human users and NHIs. Authentication, authorization, scope, and review all show up in machine traffic, only faster and at higher scale. Practitioners should stop treating API protection as a developer-only concern and fold it into identity governance, PAM, and lifecycle policy.
A few things that frame the scale:
- Secrets management is a top five cybersecurity priority for only 33% of organisations, behind cloud security (45%), API security (42%), and endpoint security (36%), according to the 2024 State of Secrets Management Survey.
- 71% of organizations use third-party APIs, according to Gartner’s 2024 data.
A question worth separating out:
Q: How should security teams handle API keys and tokens as part of identity governance?
A: Security teams should treat API keys and tokens as governed identities, not just technical secrets. That means assigning ownership, defining scope, logging use, and removing credentials when the business process ends. The same lifecycle logic used for service accounts applies here, because stale API credentials are a common path to misuse and data exposure.
👉 Read our full editorial: API security best practices are really identity governance in disguise