Trust no one, verify JWTs and incoming traffic.
5. Use API Security Testing Tools to Test Your APIs and Gateways
API security testing tools are a great way to ensure that you have the right policies in place and that they work as expected. They can also help you identify gaps in your API security strategy before hackers do it first! 
There are many different types of tests available: from simple checks against known vulnerabilities (OWASP Top 10) or common misconfigurations, to more complex ones like fuzzing or penetration testing . These tests will help you find issues with both your gateways and APIs themselves, but only if used correctly
https://t.co/AkOkcUr737