---
source_url: "https://developers.cloudflare.com/use-cases/apis/protect-apis/?utm_source=openai"
title: Protect your APIs · Cloudflare use cases
mirrored_at: 2026-08-04T13:09:20.041Z
host: developers.cloudflare.com
cited_in_42a: true
mirror_canonical: "https://index.42a.ai/developers.cloudflare.com/use-cases/apis/protect-apis/index__q__utm_source_openai"
---

> **Original source:** https://developers.cloudflare.com/use-cases/apis/protect-apis/?utm_source=openai

1.  [Home](https://developers.cloudflare.com/)
2.  /[Use cases](https://developers.cloudflare.com/use-cases/)
3.  /[APIs and microservices](https://developers.cloudflare.com/use-cases/apis/)
4.  /Protect your APIs

APIs are exposed to abuse, injection attacks, and unauthorized access. Cloudflare provides defense in depth with API Shield schema validation, per-endpoint rate limiting, mutual TLS (mTLS) client authentication, and security rules.

Discover, secure, and monitor your APIs. [Learn more about API Shield](https://developers.cloudflare.com/api-shield/).

-   **Schema validation** - Reject requests that do not conform to your OpenAPI specification before they reach your origin

Limit request rates based on flexible matching criteria. [Learn more about Rate Limiting](https://developers.cloudflare.com/waf/rate-limiting-rules/).

-   **Rate limiting** - Prevent abuse and volumetric attacks with per-IP or per-API-key request limits

Mutual TLS client certificate authentication. [Learn more about mTLS](https://developers.cloudflare.com/ssl/client-certificates/).

-   **Client authentication** - Require mutual TLS certificates for machine-to-machine communication

Get automatic protection from vulnerabilities and create your own custom rules. [Learn more about Application Security](https://developers.cloudflare.com/waf/).

-   **Attack protection** - Application security's managed rulesets block SQL injection, Cross-Site Scripting (XSS), and other injection attacks

Zero Trust access control for applications and infrastructure. [Learn more about Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/).

-   **Identity providers** - Integrate with Okta, Azure AD, Google Workspace, and other identity providers (IdPs) to gate API access
-   **Service tokens** - Issue long-lived credentials for machine-to-machine authentication between services

Build and deploy serverless applications on Cloudflare's global network. [Learn more about Workers](https://developers.cloudflare.com/workers/).

-   **JWT validation** - Verify and decode JSON Web Tokens (JWTs) at the edge before requests reach your backend
-   **Custom auth logic** - Build any authentication scheme — API keys, Hash-based Message Authentication Code (HMAC) signatures, custom headers — directly at the edge

1.  [API Shield get started](https://developers.cloudflare.com/api-shield/get-started/)
2.  [Configure rate limiting rules](https://developers.cloudflare.com/waf/rate-limiting-rules/)
3.  [Set up mTLS authentication](https://developers.cloudflare.com/ssl/client-certificates/)
4.  [Configure applications with Cloudflare Access](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/)
5.  [Service tokens](https://developers.cloudflare.com/cloudflare-one/access-controls/service-credentials/service-tokens/)
6.  [Workers get started](https://developers.cloudflare.com/workers/get-started/)

[PreviousDeploy APIs at the edge](https://developers.cloudflare.com/use-cases/apis/deploy-apis/)[NextConnect your internal network services](https://developers.cloudflare.com/use-cases/apis/internal-services/)