Security for API-first SaaS teams.
Sector threats
SaaS risk profile
API abuse
Credential stuffing, enumeration and key sharing.
Automated clients
CLI tools, scrapers and headless browsers.
OWASP on APIs
SQLi, XSS and sensitive data in JSON or query params.
Distributed attacks
Residential proxies make IP-only throttling insufficient.
API abuse
Credential stuffing, enumeration, and key sharing bypassing per-IP limits.
Automated clients
CLI tools, scrapers, and headless browsers hitting public and authenticated endpoints.
OWASP Top 10 on APIs
SQL injection, XSS, and sensitive-data patterns in JSON bodies and query parameters.
Distributed attacks
Residential proxies and shared egress make IP-only throttling insufficient.
Recommended capabilities
Per-endpoint and per-surface protection
Attach different rule groups, rate limits, and cache policies to each route under one domain — public site, authenticated API, and admin paths coexist with independent settings.
Per-domain Web ACL with priority-ordered rule groups.
Custom rules scoped by path, method, headers, and body fields.
See: Web application firewall · Load balancing & delivery
API key and session-aware rate limiting
Limits that match how SaaS APIs actually work:
Per header / API key — each customer key gets its own rate, not grouped by shared infrastructure IP.
Per cookie / session — cap abuse per authenticated user session.
Per URL parameter or body field — limit by account ID, tenant ID, or email in the request.
Composite keys — e.g. cap POST /api/v1/reset-password per email field independently of GET traffic.
See: API security
Bot control for authenticated APIs
Classify CLI clients (curl, Python requests, Axios), headless browsers, vulnerability scanners, and LLM agents. Challenge or captcha suspicious automation on login and signup; allow verified monitors. Labels flow into downstream WAF rules for tiered responses.
Upstream signals — forward verification status and API tier hints to your application.
See: Bot management
DDoS and reputation for public endpoints
Layer 7 rate limits per IP, path, and composite key. Managed IP reputation flags datacenter and scraper networks — chain to challenge before a distributed flood overwhelms shared API gateways.
See: DDoS protection
Evidence for customer security reviews
JSONL access logs with WAF action, matched rules, security labels, domain, and Request ID — per-domain attribution for support triage and security investigations. Prometheus metrics export for your existing SRE stack; live dashboard for blocks, challenges, and rule hit rates.
Adjust WAF rules, rate limits, and origins without redeploying application code.
See: Observability & operations