Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
What This Skill Does
Covers secure API design patterns for REST, GraphQL, and WebSocket APIs. Addresses authentication (JWT, OAuth 2.0, API keys), input validation, rate limiting, and the OWASP API Security Top 10. Includes working code examples for middleware, schema validation, and authorization checks.
Covers authentication, validation, rate limiting, and OWASP compliance in one place instead of requiring separate references for each concern.
When to use it
- Adding JWT authentication to a new REST API
- Locking down login endpoints against brute-force attempts
- Preventing SQL injection in user-submitted query parameters
- Enforcing role-based access control on admin routes
- Preparing an existing API for a security audit
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: How do I secure my Express API with JWT authentication and rate limiting?
- 1Reviews the existing API structure and identifies unprotected endpoints
- 2Generates JWT login and token refresh endpoints with bcrypt password hashing
- 3Creates authentication middleware that verifies tokens on protected routes
- 4Adds Redis-backed rate limiting with stricter limits on auth endpoints
- 5Applies security headers via Helmet and validates request bodies with Zod schemas
Complete Express middleware setup with JWT auth, refresh tokens, per-route rate limiting, input validation schemas, and security headers