Guard Your API: Authentication and Rate Limiting

• ✓Explain authentication and authorisation, and choose between 401, 403, 404 and 429
• ✓Store API keys and passwords so that a leaked database does not leak them
• ✓Build a login endpoint with a slow, salted password hash and signed tokens
• ✓Explain what a JWT protects and what it does not, and reject forged, edited, expired and unsigned tokens
• ✓Write FastAPI dependencies that check identity, role and ownership
• ✓Find and fix broken object-level authorisation, the most common API vulnerability
• ✓Build and compare fixed-window, sliding-window and token-bucket rate limiters
• ✓Add per-caller limits and a strict login limit, answering 429 with Retry-After
• ✓Attack your own service, and lock every defence in with automatic tests

Take an open API and make it safe to expose: prove who is calling, decide what each caller may do, limit how often they may ask, keep the secrets out of the code and the logs, and show with tests that every defence holds.