Securing Modern REST APIs: JWT vs OAuth2 vs API Keys & Rate Limiting Best Practices

In an interconnected digital economy, your APIs are the front doors to your business data and intellectual property. Whether serving mobile apps, third-party developer integrations, or internal microservices, unsecured API endpoints represent the single largest attack surface for data breaches. This handbook breaks down the three foundational authentication mechanisms—JSON Web Tokens (JWT), OAuth2, and Cryptographic API Keys—and outlines defense-in-depth API hardening patterns.

Authentication Mechanisms Compared: When to Use Which

The Short-Lived Access Token + Refresh Token Rotation Pattern

A critical flaw in naive JWT implementations is issuing tokens valid for 30 days. If an attacker intercepts the token, they possess unfettered account access for a month with zero revocation mechanism.

The Secure Pattern: Issue **short-lived Access Tokens (valid for 10–15 minutes)** coupled with **Refresh Tokens (valid for 7 days)** stored in HttpOnly cookies with automatic rotation:

// auth/tokenService.ts
import jwt from 'jsonwebtoken';
import { redis } from '@/lib/redis';

export async function rotateRefreshToken(oldRefreshToken: string, userId: string) {
  // 1. Check if token was already used (Reuse Detection / Replay Attack!)
  const isRevoked = await redis.get(`revoked_token:${oldRefreshToken}`);
  if (isRevoked) {
    // SECURITY ALERT: Compromised token reused! Invalidate ALL user sessions immediately!
    await redis.del(`user_sessions:${userId}`);
    throw new Error('Security Breach: Token reuse detected. Session invalidated.');
  }

  // 2. Blacklist the consumed refresh token in Redis
  await redis.set(`revoked_token:${oldRefreshToken}`, '1', 'EX', 60 * 60 * 24 * 7);

  // 3. Issue brand new token pair
  const newAccessToken = jwt.sign({ userId }, process.env.JWT_ACCESS_SECRET!, { expiresIn: '15m' });
  const newRefreshToken = jwt.sign({ userId }, process.env.JWT_REFRESH_SECRET!, { expiresIn: '7d' });

  return { newAccessToken, newRefreshToken };
}

Defense-in-Depth API Security Checklist

• Input Sanitization & Schema Validation: Validate 100% of incoming payloads using Zod or Pydantic before business logic execution. Reject unrecognized keys.
• Sliding-Window Rate Limiting: Enforce strict rate limits per IP and per authenticated user ID via Redis to neutralize brute-force credential stuffing and scraping.
• Disable Verbose Stack Traces: In production environments, never leak database error strings or file paths in API 500 error responses. Return standardized error codes (e.g., ERR_INTERNAL_SERVER).
• CORS Preflight Caching: Cache preflight OPTIONS responses for 24 hours to reduce latency while restricting allowed origins strictly to verified subdomains.

Frequently Asked Questions