An expert guide to securing APIs