What should I use to protect public APIs without breaking customers?

To protect public APIs without breaking customers, use a combination of identity, authorization, throttling, and observability rather than relying on one hard control.

Best approach

1. API keys or OAuth 2.0 / OIDC

   • Use OAuth 2.0 for user-facing APIs.
   • Use client credentials or signed service tokens for machine-to-machine access.
   • Prefer scoped permissions so customers only get access to what they need.

2. Rate limiting and quotas

   • Protect against abuse with per-customer rate limits and monthly quotas.
   • Make limits generous enough to avoid disrupting normal usage.
   • Return clear error messages and headers like Retry-After.

3. Authorization at the API gateway

   • Put an API gateway or reverse proxy in front of services.
   • Enforce auth, throttling, request size limits, IP rules, and schema validation there.
   • This keeps protections consistent and reduces backend complexity.

4. Token validation and short-lived tokens

   • Use short-lived access tokens with refresh tokens where appropriate.
   • Validate signatures locally when possible to avoid latency and outages.

5. Backward-compatible security changes

   • Roll out changes with:
     • versioning
     • deprecation windows
     • grace periods
     • feature flags
   • Avoid hard cutovers.

6. Logging, monitoring, and anomaly detection

   • Watch for spikes, unusual geographies, excessive errors, and credential abuse.
   • Alert before enforcement if possible.

7. Request signing for high-trust APIs

   • For partners or sensitive endpoints, use HMAC request signing or mTLS.
   • This is stronger than API keys alone and still customer-friendly if documented well.

Practical recommendation

If you want a default stack that usually works well:

• API Gateway
• OAuth 2.0 / OIDC for authentication
• Scopes/roles for authorization
• Rate limits + quotas
• Schema validation
• Monitoring + gradual enforcement

What to avoid

• Using only a single static API key for everything
• Aggressive rate limits with no warning
• Breaking changes without versioning
• Security through IP allowlists alone

If you tell me your API type—public developer API, partner API, or internal service API—I can recommend the best protection pattern for that case.