All 45 questions

  1. What techniques and tools would you use to secure a REST API?

    Asked in 6 of 377 interviews · last asked Oct 13 · Scenario · Senior

    Show answer

    I would use HTTPS, verify client identity, and check permissions on every request and resource. For user login, I would use OpenID Connect; for delegated access, OAuth 2.0 access tokens. I would also validate input, use parameterized database queries, limit request rates, protect secrets, and monitor security events.

    • Validate JWT signatures, issuer, audience, and expiry; a valid token does not grant access to every resource.
    • Use an API gateway for rate limits and request size limits, not as a replacement for application authorization.
    • Store credentials in a secrets manager, rotate them, and never log tokens or passwords.
    • Keep dependencies patched and use security scanners; CORS is a browser control, not API access protection.

    What the interviewer checks: The interviewer checks whether you can combine identity checks, resource permissions, input protection, and operational safeguards.

    Other ways it was asked
    • “How do you secure a REST API?”
    • “How do you secure a web API?”
    • “How do you secure an API?”

  2. How do you authenticate an API?

    Asked in 4 of 377 interviews · last asked Sep 19 · Concept · Junior

    Show answer

    I authenticate API requests by checking credentials, such as an API key or access token, over HTTPS. For user access, I can use OpenID Connect for login and OAuth 2.0 access tokens for API calls. After validating the credentials, I check permissions separately.

    • API keys usually identify applications, not individual users.
    • For JWT access tokens, validate the signature, issuer, audience, and expiry.
    • Return 401 for missing or invalid credentials; return 403 when valid credentials lack permission.
    • Authentication checks identity. Authorization checks what that identity can do.

    What the interviewer checks: The interviewer checks whether you can choose suitable credentials, validate them safely, and separate authentication from authorization.

    Other ways it was asked
    • “How would you implement authentication for an API?”
    • “How does authentication work in an API?”
    • “What authentication methods are commonly used in APIs?”

  3. Is it safe to pass a sensitive employee ID in the query string, and should you use GET or POST?

    Asked once · last asked Sep 21 · Scenario · Mid-level

    Other ways it was asked
    • “When sending sensitive data such as an employee ID, should you use GET or POST?”
    • “Is it safe to pass a sensitive employee ID in a GET query string, and should you switch to POST?”

  4. Is validating a request using only an ID sufficient for authentication and authorization, and why or why not?

    Asked once · last asked Apr 2 · Concept · Mid-level

  5. When should an API use an API key versus an access token to authenticate requests?

    Asked once · last asked Apr 2 · Concept · Mid-level

  6. How would you implement authentication in a backend service, and how would you use Swagger or OpenAPI to document and test it?

    Asked once · last asked Apr 9 · Tooling · Mid-level

  7. What is an authentication token, and what are some common API authentication methods?

    Asked once · last asked Apr 23 · Concept · Junior

  8. How would you authenticate a front-end UI with back-end APIs?

    Asked once · last asked May 5 · Scenario · Mid-level

  9. How would you design a simple back-end API to handle user login requests while ensuring scalability and security? Outline the key components and design decisions you would make.

    Asked once · last asked May 8 · Design · Mid-level

  10. Can you explain how you secure REST APIs in enterprise applications?

    Asked once · last asked May 14 · Scenario · Senior

  11. What are the main security pitfalls you watch for in web APIs, and how do you systematically prevent them?

    Asked once · last asked May 16 · Scenario · Senior

  12. Could you elaborate on how you implement input validation and sanitization in your APIs to prevent injection attacks? What specific techniques or libraries do you use?

    Asked once · last asked May 16 · Scenario · Mid-level

  13. Can you maintain a session in an API-based application with separate front end and back end, and if so, how?

    Asked once · last asked May 25 · Concept · Mid-level

  14. How does CORS work in a REST API?

    Asked once · last asked May 25 · Concept · Mid-level

  15. How would you keep `/health` and `/login` publicly accessible while protecting `/product`?

    Asked once · last asked May 27 · Scenario · Mid-level

  16. How would you secure AWS and GCP infrastructure and APIs handling high-volume financial data for a fintech or crypto SaaS platform?

    Asked once · last asked Jun 15 · Scenario · Senior

  17. What encryption methods would you use to protect data handled by an API?

    Asked once · last asked Jun 18 · Concept · Mid-level

  18. How should data encryption and decryption work when a frontend requests a user list from a backend API?

    Asked once · last asked Jun 18 · Scenario · Mid-level

  19. In an API that returns a user list, where should decryption keys be handled, and what data should they protect?

    Asked once · last asked Jun 18 · Design · Senior

    Other ways it was asked
    • “In an API flow that encrypts user-list data, how should the decryption key be handled, and should the response remain encrypted?”

  20. In an API, what's the practical difference between authentication and authorization, and what's one common bug that leads to an IDOR vulnerability?

    Asked once · last asked Jul 16 · Concept · Mid-level

  21. What security and scalability best practices do you follow when designing an API for another system to call?

    Asked once · last asked Jul 16 · Design · Senior

  22. How do you ensure secure handling of auth tokens and sensitive headers when integrating a third-party SDK, for example analytics or payments, alongside your own REST API client?

    Asked once · last asked Jul 20 · Scenario · Senior

  23. How would you verify the authenticity of an incoming webhook request?

    Asked once · last asked Jul 26 · Concept · Senior

  24. How can you verify that an incoming webhook request came from the expected provider?

    Asked once · last asked Jul 27 · Concept · Mid-level

    Other ways it was asked
    • “How can you verify that an incoming request came from Retell?”

  25. How would you segregate and map 50,000 accounts across AWS and Azure for 200 developers, and where would you use REST APIs in that process?

    Asked once · last asked Jul 31 · Design · Senior

  26. How would you secure a REST API using JWT tokens and role-based authorization? What key configuration steps would you need to take in your application?

    Asked once · last asked Aug 5 · Scenario · Mid-level

  27. How would you configure API access for humans versus services?

    Asked once · last asked Aug 13 · Concept · Senior

  28. How do you secure an API using OAuth 2.0, and what's the difference between an access token and a refresh token?

    Asked once · last asked Aug 14 · Concept · Mid-level

  29. What's the purpose of the OAuth 2.0 scope parameter, and how would you use scopes to enforce least privilege in an API?

    Asked once · last asked Aug 14 · Concept · Senior

  30. How do you handle expired or invalid JWT tokens, and how does that affect user experience?

    Asked once · last asked Aug 20 · Scenario · Mid-level

  31. How would you use middleware to restrict an operation to users with a specific role?

    Asked once · last asked Aug 24 · Scenario · Mid-level

  32. Where do you usually carry an auth token in a request?

    Asked once · last asked Sep 2 · Concept · Junior

  33. When an application encounters an error, how do you avoid exposing sensitive code or service details in the UI, and what should the user see?

    Asked once · last asked Sep 5 · Scenario · Mid-level

  34. How do you handle errors and exceptions in an authentication flow?

    Asked once · last asked Sep 15 · Scenario · Mid-level

    Other ways it was asked
    • “How do you handle error exceptions in the authentication flow?”

  35. When a password is changed for an existing token, should the system automatically generate a new API key?

    Asked once · last asked Sep 18 · Scenario · Mid-level

  36. How is an authentication token generated and verified, and how do you send it to an API for verification?

    Asked once · last asked Sep 19 · Concept · Mid-level

  37. How do you secure API calls in a frontend application, including authentication and validation of returned data?

    Asked once · last asked Sep 20 · Scenario · Mid-level

  38. If a developer retrieves employee data using a GET request with an employee ID in the query string, is it safe or unsafe?

    Asked once · last asked Sep 21 · Scenario · Mid-level

  39. What steps should you take to avoid passing a sensitive employee ID in a URL?

    Asked once · last asked Sep 21 · Scenario · Mid-level

  40. How would you securely call OpenAI or Gemini APIs in a production application?

    Asked once · last asked Sep 28 · Scenario · Mid-level

  41. How would you securely validate and handle an incoming webhook, including signature verification and timestamp or replay protection, and what HTTP response codes would you return for a successful request versus an invalid signature?

    Asked once · last asked Sep 28 · Scenario · Senior

  42. How do you secure an API service from an iOS application?

    Asked once · last asked Sep 30 · Scenario · Senior

  43. How can you protect an API in API Gateway?

    Asked once · last asked Oct 22 · Scenario · Mid-level

  44. How would you verify that an agent is a valid Gorgias user before sending a message?

    Asked once · last asked Sep 30 · Scenario · Mid-level

  45. How do you approach API design and authentication in a web application?

    Asked once · last asked Jan 22 · Concept · Junior

More REST API interview questions

How this list is made

Every question here was asked by a real interviewer in a real job interview that a candidate ran MeetAssist in. After the call, the interviewer's questions are pulled from the transcript. Practice sessions, tests, exams and anything that was not a job interview are dropped.

Questions are rewritten so they make sense on their own: names of people, employers and clients are removed, and speech-to-text mistakes are fixed. Small talk, logistics and questions about one candidate's own résumé are left out. Rephrasings of the same question are merged, and the count is the number of different interviews it came up in.

The interviews come from candidates who use MeetAssist, so they lean towards software, data and AI roles: the shares describe these interviews, not every REST API interview. Answers to the most asked questions are written and checked by an editor; a "common mistake" is shown only when reviews of real answers in these interviews show it, with the count.

377 interviews, 243 candidates, Jan 2026 to Oct 2026. Updated every month with new interviews.