> Markdown version of [/videos/377-architecting-api-security?t=2265](https://www.wearedevelopers.com/videos/377-architecting-api-security?t=2265). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Architecting API Security

An attacker breaches your API gateway and suddenly gains unchecked access across your trusted network. Prevent catastrophic lateral movement by shifting from perimeter defenses to a zero-trust architecture.

- **Speakers:** Philippe De Ryck
- **Event:** WeAreDevelopers LIVE
- **Published:** April 29, 2022
- **Duration:** 47:34
- **URL:** https://www.wearedevelopers.com/videos/377-architecting-api-security

## Summary

Modern API architecture cannot rely solely on perimeter defenses. When attackers bypass an API gateway—such as compromising an image handling service via remote code execution—they gain unchecked lateral access within the trusted network. Transitioning from perimeter-based defense to a zero-trust architecture is essential. Engineering teams must design systems under the assumption that breaches will occur, shifting their focus to structural containment and granular, multi-layered access control.

The first step to limiting a breach's blast radius is strict compartmentalization. Untrusted or historically vulnerable components, like document parsing or image scaling libraries, should be fully isolated into dedicated trust zones using sandboxing, segmented networks, or distinct container environments. Additionally, service-to-service interaction inside the network must be heavily restricted. By implementing mutual TLS or dedicated API keys for inter-API authentication—leveraging solutions like an Istio service mesh—systems ensure internal endpoints only accept requests from explicitly authorized internal callers.

Propagating user context to these internal APIs is equally critical to prevent broken object level authorization vulnerabilities. Rather than letting the gateway blindly strip user identity, architectures must reliably forward authentication state downstream so isolated backend services can perform independent permission checks. However, exposing data-rich JSON Web Tokens directly to frontend clients complicates session revocation and significantly expands the attack surface. A highly secure pattern uses the API gateway to issue simple, opaque reference tokens to the application client, which are dynamically exchanged for rich internal jwts during routing. Ultimately, effective API security prioritizes continuous defense-in-depth capabilities while defaulting to the simplest maintainable systems required to satisfy internal trust boundaries.

**Keywords:** api security architecture, zero-trust api design, service compartmentalization, remote code execution vulnerabilities, defense-in-depth modeling, inter-api authentication, mutual tls implementation, istio service mesh policies, broken object level authorization, authentication state propagation, json web token security, gateway reference tokens, jwt revocation challenges, sandboxing untrusted services, fine-grained internal access control

## Chapters

1. **Designing APIs for security from day one** (00:00) — Prioritizing early architectural design prevents critical authorization and authentication flaws commonly found in real-world application deployments.
1. **Establishing a baseline modern API architecture** (03:26) — A typical modern infrastructure utilizes reverse proxies and API gateways to route authorized traffic to monolithic or microservice components.
1. **How internal vulnerabilities breach perimeter security** (05:56) — Exploiting standard processes like image conversion demonstrates why relying solely on perimeter defenses leaves internal trusted zones entirely defenseless against remote code execution.
1. **Containing lateral threats with service compartmentalization** (14:01) — Isolating untrusted or highly sensitive services into distinct trust zones mitigates widespread infrastructure compromise when targeted individual components fail.
1. **Enforcing zero trust policies with inter-API authentication** (19:27) — Implementing strict caller verification and explicit communication paths stops compromised internal services from arbitrarily traversing the backend network.
1. **Forwarding authentication state via token relay** (24:18) — Relaying identity contexts past the external gateway empowers internal microservices to execute precise object-level authorization decisions for individual users.
1. **Security drawbacks of exposing JWTs to clients** (29:33) — Delivering raw JSON web tokens to frontend clients incurs large network overheads, complicates session revocation, and risks leaking sensitive backend claim data.
1. **Obfuscating JWTs with API gateway reference tokens** (32:19) — Gateways can maintain server-side token state and issue opaque reference identifiers to clients to obscure internal authorization topologies and simplify session invalidation.
1. **Key architectural takeaways for building secure APIs** (35:45) — Assuming breach necessitates prioritizing simple, compartmentalized architectural solutions that leverage edge gateways to shield internal implementation complexities.
1. **Audience Q&A on fine-grained access and JWT encryption** (37:45) — Addressing inquiries regarding career paths, configuring fine-grained access with open policy agents, and the challenges of managing keys for token encryption.

## Related Moments

- [Designing a resilient API gateway architecture](https://www.wearedevelopers.com/videos/54-improving-developer-happiness-with-gitops) (from "Improving Developer Happiness with GitOps")
- [The current state of enterprise APIs and security trends](https://www.wearedevelopers.com/videos/1574-lessons-learned-from-observing-a-billion-api-requests) (from "Lessons learned from observing a billion API requests")
- [Final code walk-through and audience Q&A session](https://www.wearedevelopers.com/videos/831-creating-a-routing-app-with-google-maps-api-from-scratch) (from "Creating a routing app with Google Maps API from scratch")
- [Securing exposed application programming interfaces against unauthenticated access](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) (from "Security Pitfalls for Software Engineers")
- [Addressing insecure design through early threat modeling](https://www.wearedevelopers.com/videos/100072-bulletproof-web-applications-the-2025-owasp-top-ten) (from "Bulletproof Web Applications: The 2025 OWASP Top Ten")
- [Applying zero trust architecture to backend microservices](https://www.wearedevelopers.com/videos/100089-trust-issues-because-zero-trust-isn-t-optional-anymore) (from "Trust Issues: Because Zero-Trust Isn’t Optional Anymore")

## Related Articles

- [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities)
- [Security Basics for Vibe Coders](https://www.wearedevelopers.com/magazine/598-security-basics-for-vibe-coders)
- [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks)
- [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)

## Related Jobs

- [Security Architect - AI](https://www.wearedevelopers.com/jobs/ext/1581899-security-architect-ai) at **ZEISS Group**
- [Staff Engineer, Security Engineering Partners](https://www.wearedevelopers.com/jobs/ext/1187268-staff-engineer-security-engineering-partners) at **Twilio**
- [Principal Software Engineer, Identity](https://www.wearedevelopers.com/jobs/ext/1469181-principal-software-engineer-identity) at **GitHub**
- [Security Engineer](https://www.wearedevelopers.com/jobs/ext/1574416-security-engineer) at **Twilio**
- [Senior Security Engineer, Incident Response](https://www.wearedevelopers.com/jobs/ext/1347114-senior-security-engineer-incident-response) at **Twilio**
- [Security Engineer, Incident Response](https://www.wearedevelopers.com/jobs/ext/1249908-security-engineer-incident-response) at **Twilio**