--- title: "#api-security articles | Hashnode" description: "Explore 244 articles tagged #api-security on Hashnode. Tutorials, guides, and how-tos from the community." url: "https://hashnode.com/tag/api-security" --- Tag # #api-security 244 posts · 61 followers [Mayowa Ogungbola](https://hashnode.com/@Phenzic) · [2d ago](https://hashnode.com/posts/building-shiplogue-made-me-think-differently-about-api-security/6af4fcb2bfd92152d2196e41) ### [Building Shiplogue Made Me Think Differently About API Security](https://phensics.hashnode.dev/building-shiplogue-made-me-think-differently-about-api-security?utm_source=hashnode&utm_medium=feed) What building a cloud-backed developer tool taught me about authentication, authorization, and securing APIs. 5 min read · [phensics.hashnode.dev](https://phensics.hashnode.dev/building-shiplogue-made-me-think-differently-about-api-security?utm_source=hashnode&utm_medium=feed) [Abdulahmed Abdulhakeem](https://hashnode.com/@abdulahmed-dev) · [3d ago](https://hashnode.com/posts/hmac-request-signing-in-laravel-make-the-signature-format-explicit/6af30909606603ddc66258b8) ### [HMAC Request Signing in Laravel: Make the Signature Format Explicit](https://abdulahmed.hashnode.dev/hmac-request-signing-in-laravel-make-the-signature-format-explicit?utm_source=hashnode&utm_medium=feed) HMAC integrations fail when services disagree on bytes or encoding. Define signing contracts across Laravel, SDKs and ML services. 8 min read · [abdulahmed.hashnode.dev](https://abdulahmed.hashnode.dev/hmac-request-signing-in-laravel-make-the-signature-format-explicit?utm_source=hashnode&utm_medium=feed) [Israr Kundi](https://hashnode.com/@israr-kundi) · [Nov 5](https://hashnode.com/posts/my-api-key-is-visible-in-the-code-how-to-fix-it/6aec5cee78b367a288efd5fb) ### [My API Key Is Visible in the Code — How to Fix It](https://israr-kundi.hashnode.dev/my-api-key-is-visible-in-the-code-how-to-fix-it?utm_source=hashnode&utm_medium=feed) My API key is visible in the code — 41% of vibe-coded apps expose secrets. Rotate the leaked key, move calls server-side, and stop the leak. 5 min read · [israr-kundi.hashnode.dev](https://israr-kundi.hashnode.dev/my-api-key-is-visible-in-the-code-how-to-fix-it?utm_source=hashnode&utm_medium=feed) [Anonymous Endpoint](https://hashnode.com/@anonymousendpoint) · [Nov 4](https://hashnode.com/posts/20-questions-to-ask-before-choosing-a-cybersecurity-engineering-integration-partner/6aeb3935c0deda1c04dc75aa) ### [20 Questions to Ask Before Choosing a Cybersecurity Engineering & Integration Partner](https://cyberpod.hashnode.dev/20-questions-to-ask-before-choosing-a-cybersecurity-engineering-integration-partner?utm_source=hashnode&utm_medium=feed) Choosing a cybersecurity engineering partner? Explore 20 essential questions on SIEM/SOAR, API security, integration quality, scalability, and support. 14 min read · [cyberpod.hashnode.dev](https://cyberpod.hashnode.dev/20-questions-to-ask-before-choosing-a-cybersecurity-engineering-integration-partner?utm_source=hashnode&utm_medium=feed) [Krishnam Murarka](https://hashnode.com/@krishnamm) · [Nov 2](https://hashnode.com/posts/dpop-and-mtls-both-get-harder-at-the-reverse-proxy/6ae82c653290b00a26dc2b4a) ### [DPoP and mTLS both get harder at the reverse proxy](https://edilec-engineering.hashnode.dev/dpop-and-mtls-both-get-harder-at-the-reverse-proxy?utm_source=hashnode&utm_medium=feed) A bearer token works for whoever holds it. Sender-constrained tokens add a condition: the caller also has to prove it holds a private key that the token was bound to. OAuth has two standard ways to do 5 min read · [edilec-engineering.hashnode.dev](https://edilec-engineering.hashnode.dev/dpop-and-mtls-both-get-harder-at-the-reverse-proxy?utm_source=hashnode&utm_medium=feed) [1](https://hashnode.com/posts/dpop-and-mtls-both-get-harder-at-the-reverse-proxy/6ae82c653290b00a26dc2b4a) [Cruxtab Technologies Pvt. Ltd.](https://hashnode.com/@cruxtab) · [Oct 31](https://hashnode.com/posts/responding-to-an-exposed-google-api-key-in-a-git-repository/6ae5cd88765e6a14f19ad94b) ### [Responding to an Exposed Google API Key in a Git Repository](https://cruxtab-technologies.hashnode.dev/responding-to-an-exposed-google-api-key-in-a-git-repository?utm_source=hashnode&utm_medium=feed) Learn how to remediate an exposed Google API key by rotating credentials, applying restrictions, cleaning Git history, and implementing secret scanning. 4 min read · [cruxtab-technologies.hashnode.dev](https://cruxtab-technologies.hashnode.dev/responding-to-an-exposed-google-api-key-in-a-git-repository?utm_source=hashnode&utm_medium=feed) [Cruxtab Technologies Pvt. Ltd.](https://hashnode.com/@cruxtab) · [Oct 30](https://hashnode.com/posts/protecting-api-credentials-in-shopify-app-integrations/6ae46497558620bf6a5b1f89) ### [Protecting API Credentials in Shopify App Integrations](https://cruxtab-technologies.hashnode.dev/protecting-api-credentials-in-shopify-app-integrations?utm_source=hashnode&utm_medium=feed) Learn how to protect API keys, service-account credentials, and webhook URLs in Shopify applications using server-side processing and secure configuration. 3 min read · [cruxtab-technologies.hashnode.dev](https://cruxtab-technologies.hashnode.dev/protecting-api-credentials-in-shopify-app-integrations?utm_source=hashnode&utm_medium=feed) [Cruxtab Technologies Pvt. Ltd.](https://hashnode.com/@cruxtab) · [Oct 29](https://hashnode.com/posts/keeping-shopify-session-scopes-in-sync/6ae2db44594fe37cd92aacd3) ### [Keeping Shopify Session Scopes in Sync](https://cruxtab-technologies.hashnode.dev/keeping-shopify-session-scopes-in-sync?utm_source=hashnode&utm_medium=feed) Learn how to maintain accurate Shopify session scope metadata when granted permissions change, including session storage, validation, and webhook delivery. 3 min read · [cruxtab-technologies.hashnode.dev](https://cruxtab-technologies.hashnode.dev/keeping-shopify-session-scopes-in-sync?utm_source=hashnode&utm_medium=feed) [Cruxtab Technologies Pvt. Ltd.](https://hashnode.com/@cruxtab) · [Oct 28](https://hashnode.com/posts/protecting-a-shopify-form-endpoint-with-recaptcha-and-server-side-validation/6ae19cdc54e9b73851fd75d4) ### [Protecting a Shopify Form Endpoint with reCAPTCHA and Server-Side Validation](https://cruxtab-technologies.hashnode.dev/protecting-a-shopify-form-endpoint-with-recaptcha-and-server-side-validation?utm_source=hashnode&utm_medium=feed) Learn how reCAPTCHA, server-side validation, rate limiting, and honeypots can work together to protect public Shopify form submission endpoints. 3 min read · [cruxtab-technologies.hashnode.dev](https://cruxtab-technologies.hashnode.dev/protecting-a-shopify-form-endpoint-with-recaptcha-and-server-side-validation?utm_source=hashnode&utm_medium=feed) [404 Founders](https://hashnode.com/@404-founders) · [Oct 20](https://hashnode.com/posts/ghostaction-github-actions-supply-chain-ai-api-keys-2026/6adc33243c56f5422d5ba5f6) ### [GhostAction Never Stopped: 1,900 Accounts, 30,000 Repos, and a Year of Stolen Keys](https://404-founders.com/blog/ghostaction-github-actions-supply-chain-ai-api-keys-2026?utm_source=hashnode&utm_medium=feed) The GitHub Actions supply chain campaign that never stopped - and why AI API keys made it much more valuable 8 min read · [404-founders.com](https://404-founders.com/blog/ghostaction-github-actions-supply-chain-ai-api-keys-2026?utm_source=hashnode&utm_medium=feed)