Skip to content
API Shield
Visit API Shield on GitHub
Set theme to dark (⇧+D)

Cloudflare API Shield

Cloudflare offers a range of products to help identify and address API vulnerabilities.

Why care about API security?

APIs have become the backbone of popular web services, helping the Internet become more accessible and useful.

As APIs have become more prevalent, however, so have their problems:

  • Many companies have thousands of APIs, including ones they do not even know about.
  • To support a large base of users, many APIs are protected by a negative security model that makes them vulnerable to credential-stuffing attacks and automated scanning tools.
  • With so many endpoints and users, it’s difficult to recognize brute-force attacks against specific endpoints.
  • Sophisticated attacks are even harder to recognize, often because even development teams are unaware of common and uncommon usage patterns.


Cloudflare offers the following features to help learn about and secure your APIs:

For additional details, see our blog post.


Cloudflare API Security products are available to Enterprise customers only, though anyone can set up Mutual TLS with a Cloudflare-managed certificate authority.

Additionally, API Discovery, Volumetric Abuse Detection, and Sequential Abuse Detection are currently enabled by request. If you are interested in using these products, contact your account team.