Let's say I'm running a website and it has API used by other client (Android app, etc.). If I open the API and document, anyone can use the API to create the client apps for my website. But is it dangerous for my website or the data of the site (users'accounts information, etc.)? If so, what are the best practices if I still want to open the API? (It's also acceptable if the API detail is public but only accessible for my own apps, such as using something likes "app key".)

closed as too broad by Gilles 'SO- stop being evil', CaffeineAddiction, Steffen Ullrich, Matthew, Steve Mar 13 '17 at 19:42

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 3
    Welcome to security.stackexchange.com. Your question is very broad and therefore hard to answer. That said, note that making an API public doesn't have anything to do with whether you publish an API documentation. Not publishing documentation just obscures the API, it doesn't secure it. A public API is an API that doesn't require authorization. So if you don't implement authentication and authorization, for example with an app key, then your API is already public. Besides authorization, don't forget secondary measures such as rate limiting. – Out of Band Mar 11 '17 at 18:56

Browse other questions tagged or ask your own question.