<!-- Source: https://www.wappi.dev/security -->

# Security

Wappi provides comprehensive security features to protect your API and ensure secure communication between your frontend and backend applications.

## Security Overview

Security in Wappi is built around multiple layers of protection:

- **API Key Authentication** - Secure your API endpoints with API keys
- **JWT Authentication** - Token-based authentication for user sessions
- **Domain Whitelisting** - Restrict API access to specific domains
- **Request Validation** - Validate all incoming requests and data
- **Rate Limiting** - Protect against abuse and DDoS attacks
- **HTTPS Enforcement** - Secure communication over encrypted connections

## Built-in Security Features

### Automatic Request Validation

Wappi automatically validates all incoming requests against your defined types and schemas:

```typescript
// Automatic validation based on endpoint types
interface User_CreateUser_1_0_0__Body {
  name: string
  email: string
  password: string
}

// Wappi automatically validates the request body
// Invalid requests are rejected before reaching your endpoint
```

### Domain Whitelisting

Configure allowed domains in your `wappi.json` configuration:

```json
{
  "domains": "yourdomain.com, api.yourdomain.com, www.yourdomain.com",
  "private": false
}
```

### Environment-based Security

Different security settings for different environments:

```bash
# Development
ENVIRONMENT=localhost
SHOW_LOGS=true

# Production
ENVIRONMENT=prod
SHOW_LOGS=false
AUTH_KEY_CURRENT=your-production-key
AUTH_KEY_PREVIOUS=your-previous-key
```

## Security Best Practices

- Always use HTTPS in production environments
- Regularly rotate your API keys and JWT secrets
- Implement proper input validation and sanitization
- Use environment variables for sensitive configuration
- Enable logging for security events and monitoring
- Implement rate limiting to prevent abuse
- Keep your dependencies up to date
- Use strong, unique passwords and secrets

## Security Headers

Wappi automatically sets important security headers:

```typescript
// Automatically set by Wappi
{
  "X-Content-Type-Options": "nosniff",
  "X-Frame-Options": "DENY",
  "X-XSS-Protection": "1; mode=block",
  "Strict-Transport-Security": "max-age=31536000; includeSubDomains",
  "Content-Security-Policy": "default-src 'self'"
}
```

## Error Handling

Secure error handling prevents information leakage:

```typescript
// Production error response (no sensitive information)
{
  "success": false,
  "message": "Authentication failed",
  "statusCode": 401
}

// Development error response (detailed for debugging)
{
  "success": false,
  "message": "JWT token expired at 2024-01-15T10:30:00Z",
  "statusCode": 401,
  "stack": "Error: JWT expired..."
}
```

## Next Steps

Explore the specific security features:

- [API Keys](https://www.wappi.dev/security/api-keys) - Learn about API key authentication
- [JWT Authentication](https://www.wappi.dev/security/jwt-authentication) - Implement JWT-based user authentication

URL: https://www.wappi.dev/security