API authentication attacks

When it applies

An API authenticates requests via tokens/keys/sessions. Auth is the gate; weaknesses here open everything behind it.

Why it works

APIs sprawl (many endpoints, versions, clients) so authentication is applied inconsistently: some routes forgot it, tokens are long-lived or weakly signed, keys leak client-side, and error/timing differences enable enumeration and brute force.