Back to Business Mode
API Security
APIs are consumed by code, not humans, which means every check has to be enforced by the server, not assumed from good client behavior.
JWT validation confirms who is calling and that the token hasn't expired or been tampered with
Rate limiting protects both availability and business logic (e.g. coupon abuse)
HMAC request signing proves the request body wasn't modified in transit
Nonces and timestamps stop a captured request from being successfully replayed
Hands-on demo
POST /api/orders
Authorization: Bearer <JWT> · X-Signature: <HMAC>
BrowserSigned request assembled
CloudflareRate limit + WAF check
AWSNetwork firewall + load balancer
ApplicationJWT + HMAC + replay validation
DatabaseOrder persisted
Try it yourself
Try it yourself — run a scenario below, then flip this and replay it to see what changes.
Full Request Lifecycle
Follow one API call through every layer, in order.
Want this flow explained in detail as it plays?
app.flowground.dev
API request
MethodPOST
Path/api/orders
Browser
Cloudflare
Application
POST /api/orders with a JWT in the Authorization header and an HMAC signature header.
Selected hop
Browser sends signed API request
Browser
The user's browser — where every request actually originates and every response is rendered.
Cloudflare
The edge network in front of the origin — filters and rate-limits traffic before it ever reaches the app.
What happens here
POST /api/orders with a JWT in the Authorization header and an HMAC signature header.