How to manage a secure API with external app usage
Answered
British Shorthair posted this in #help-forum
British ShorthairOP
Hi everyone, I'm reaching out because I could really use some guidance on creating and managing a secure API with
1. How to make it secure? How to prevent people from using each other's URL. How would using API keys work?
2. How to monitor usage? The API will have different plans and when someone makes like 100
3. Prevent spamming
Any help is appreciated.
next 13. The API will be used by external apps and I want to ensure it will be capable of handling potential issues like spamming, hacking etc. The project is simple, users can create forms in which they get an API URL and when the form is submitted the dashboard will contain the new form data. I have a couple of questions listed below:1. How to make it secure? How to prevent people from using each other's URL. How would using API keys work?
2. How to monitor usage? The API will have different plans and when someone makes like 100
POST calls in a month and tries for the 101th time, he shouldn't be allowed.3. Prevent spamming
Any help is appreciated.
Answered by @ts-ignore
## 1. How to make it secure?
Use ratelimiting(you can upstash), provide api keys to users
## 2. How to monitor usage?
Keep track of it in db, when user hit your api just increase it and if it goes above 100 throw an error
Use ratelimiting(you can upstash), provide api keys to users
## 2. How to monitor usage?
Keep track of it in db, when user hit your api just increase it and if it goes above 100 throw an error
11 Replies
@British Shorthair Hi everyone, I'm reaching out because I could really use some guidance on creating and managing a secure API with `next 13`. The API will be used by external apps and I want to ensure it will be capable of handling potential issues like spamming, hacking etc. The project is simple, users can create forms in which they get an API URL and when the form is submitted the dashboard will contain the new form data. I have a couple of questions listed below:
**1. How to make it secure?** How to prevent people from using each other's URL. How would using API keys work?
**2. How to monitor usage?** The API will have different plans and when someone makes like 100 `POST` calls in a month and tries for the 101th time, he shouldn't be allowed.
**3. Prevent spamming**
Any help is appreciated.
## 1. How to make it secure?
Use ratelimiting(you can upstash), provide api keys to users
## 2. How to monitor usage?
Keep track of it in db, when user hit your api just increase it and if it goes above 100 throw an error
Use ratelimiting(you can upstash), provide api keys to users
## 2. How to monitor usage?
Keep track of it in db, when user hit your api just increase it and if it goes above 100 throw an error
Answer
British ShorthairOP
So in the API route, multiple calls to the database have to be made
British ShorthairOP
What about spamming
@British Shorthair What about spamming
that will be handled under ratelimit ig
British ShorthairOP
And also how would api keys work
@British Shorthair And also how would api keys work
tell them to provide it in headers or as a query parameter
British ShorthairOP
Ok, and when the fetch is called, i verify the API and then continie
Continue*
yes
British ShorthairOP
Thanks