---
title: "API security · Agent Wranglers"
url: https://agentwranglers.se/playbook/api-design/api-security
updated: 2026-10-20
licence: "All rights reserved"
---

# API security

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

> Authenticate every call with scoped tokens, authorise every object, and keep secrets out of addresses. Link to the security playbook for the attacks.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers api design playbook: https://agentwranglers.se/playbook/api-design/api-security`.

## Required

- [Authenticate with tokens in headers](https://agentwranglers.se/playbook/api-design/api-security/token-auth): Authenticate API calls with short-lived tokens in the `Authorization` header, issued through OAuth 2 for anything acting for a user.
- [Grant narrow scopes](https://agentwranglers.se/playbook/api-design/api-security/token-scopes): Give each token only the scopes its job needs, and check the scope on every endpoint.
- [Authorise every object](https://agentwranglers.se/playbook/api-design/api-security/object-authorisation): Check on every request that the caller may access the exact object, not just the endpoint.
- [Keep secrets out of addresses](https://agentwranglers.se/playbook/api-design/api-security/no-secrets-in-urls): Never put tokens, keys or personal data in paths or query strings. Send them in headers or the body.
- [Store API keys as hashes](https://agentwranglers.se/playbook/api-design/api-security/api-keys): Show each API key once, store only its hash, and let clients hold two keys at a time so they can rotate.
- [Refuse plain HTTP on the API](https://agentwranglers.se/playbook/api-design/api-security/api-https-only): Serve the API over HTTPS only. Refuse plain HTTP calls with an error instead of redirecting them.
- [List every API you run](https://agentwranglers.se/playbook/api-design/api-security/inventory): Keep a list of every API, version and host you expose, and switch off what is no longer used.

- Previous: [Reliability](https://agentwranglers.se/playbook/api-design/reliability)
- Next: [Contracts and docs](https://agentwranglers.se/playbook/api-design/contracts-and-docs)
- [All chapters](https://agentwranglers.se/playbook/api-design)