Let's say I'm running a website and it has API used by other client (Android app, etc.). If I open the API and document, anyone can use the API to create the client apps for my website. But is it dangerous for my website or the data of the site (users'accounts information, etc.)? If so, what are the best practices if I still want to open the API? (It's also acceptable if the API detail is public but only accessible for my own apps, such as using something likes "app key".)

  • 3
    Welcome to security.stackexchange.com. Your question is very broad and therefore hard to answer. That said, note that making an API public doesn't have anything to do with whether you publish an API documentation. Not publishing documentation just obscures the API, it doesn't secure it. A public API is an API that doesn't require authorization. So if you don't implement authentication and authorization, for example with an app key, then your API is already public. Besides authorization, don't forget secondary measures such as rate limiting. – Out of Band Mar 11 '17 at 18:56

Browse other questions tagged or ask your own question.