API Security

This lesson covers API Security. You do not need to memorize everything. Understand the flow first.

What you will learn

• What api security means — in normal words, not textbook words
• How it works step by step
• Code you can run today on your laptop
• Where teams use this in real projects

Before you start

• Software: Node.js LTS from nodejs.org, VS Code, and a terminal
• Knowledge: Earlier lessons in this Node.js course
• Previous lesson: Mongoose — Complete Guide

Explain it simply

API security means validating input, using HTTPS, hashing passwords, and limiting who can call admin endpoints.

Why developers use this

• Powers mobile and web clients
• Good APIs prevent bugs
• Employers expect this

How it works (step by step)

1. Client sends HTTP method + URL + optional JSON body.
2. Server validates input — reject bad data with 400.
3. Business logic reads or writes the database.
4. Response is JSON with a clear message the frontend can show.

Code example — type this yourself

const bcrypt = require('bcrypt');
const hash = await bcrypt.hash(password, 10);
const ok = await bcrypt.compare(password, user.passwordHash);

Never store plain passwords. Combine bcrypt with JWT or sessions for login.

What each part does

• const bcrypt = require('bcrypt'); — Loads a built-in module or package you installed with npm.
• const hash = await bcrypt.hash(password, 10); — Async work — Node can serve other users while this waits.
• const ok = await bcrypt.compare(password, user.passwordHash); — Async work — Node can serve other users while this waits.

Real life: where API Security shows up

A mobile app talks to a Node backend using API Security. The phone sends JSON; the server validates, saves to PostgreSQL, and returns clear success or error messages.

Try it yourself — hands-on

1. Create a new file (e.g. api-security-demo.js) in an empty folder
2. Type the example code for API Security yourself — typing helps memory
3. Run node on that file and read the output
4. Change one line (a value, a message, a route path) and run again to see what breaks or improves

Common mistakes (avoid these)

• Skipping the terminal — API Security only feels easy after you run code yourself.

Interview note

Be ready to explain API Security with a real trade-off: what problem it solves and what you would not use it for.

Summary

• You can explain API Security in your own words
• You ran working code — not just read about it
• You know one mistake to avoid and one real place teams use this