Secure APIs: rate limiting, OAuth, and PKCE for mobile apps
Protect APIs exposed to mobile apps: throttling, OAuth 2.1, and PKCE per OWASP.
San Juan startups and mainland teams serving Puerto Rico users launch mobile apps against REST APIs without rate limiting — an invitation to credential stuffing and catalog scraping. OWASP API Security Top 10 lists broken authentication and unrestricted resource consumption in top positions; OAuth 2.1 with PKCE is baseline for public mobile clients.
PKCE (Proof Key for Code Exchange) prevents authorization code interception in native apps without embedded client secret. Implement in React Native, Flutter, or Swift — never disable PKCE "because it complicates QA." Bruce Schneier emphasizes correct protocol cryptography matters more than exotic algorithms; PKCE is a mature standard.
Rate limiting by IP, user, and API key: token bucket or sliding window at API gateway (Kong, AWS API Gateway, Cloudflare). Differentiated thresholds — login endpoint stricter than public catalog. Alerts when legitimate Puerto Rico user on 4G hits limit from shared NAT; temporary whitelist with captcha.
Refresh token rotation, short-lived access tokens, and centralized revocation. Store tokens in Keychain/Keystore, never plain AsyncStorage. OWASP MASVS covers mobile storage — audit before App Store publish with PR client data.
Document minimum scopes: a Carolina delivery app does not need admin scope. Review third-party SDKs on mobile — analytics kits exfiltrating PII violate local and mainland compliance. Secure API enables continental retail partnerships; open API is an incident waiting for deadline.
Writes about practical cybersecurity for SMBs in Puerto Rico and the Caribbean — no fluff, just what actually needs to get done.
