Teresa is worried about attacks against an application programming interface (API) that her company supplies for its customers. What should she recommend to make sure that the API is only used by customers who have paid for the service?

The simplest way to ensure that APIs are only used by legitimate users is to require the use of authentication. API keys are one of the most frequently used methods for this. If an API key is lost or stolen, the key can be invalidated and reissued, and since API keys can be matched to usage, Teresa’s company can also bill customers based on their usage patterns if they want to. A firewall or IP restrictions may be able to help, but they can be fragile; customer IP addresses may change. An intrusion prevention system (IPS) can detect and prevent attacks, but legitimate users would be hard to tell from those who are not customers using an IPS.