APIs cover 80% of all internet traffic. Data breaches are on the news every week and API vulnerabilities are often the root cause. Securing APIs is not an easy task because it involves API Gateways, API Management Platforms, one or more cloud platforms, maybe container technologies to host APIs, Authentication and Authorization (OIDC, oAuth), Web Application Firewall (WAF), API Security Policies, Logging, Alerting and Monitoring, not to mention about securitytesting automation within the CI/CD pipelines. With all these complexity, is it possible to secure environments that hosts API and API itself? This talk will cover the best practices you can adopt to beef up your API Security in your environment. I will also cover how to practically divide up the roles and responsibilities on securing an API during its lifecycle. At the end of the day, we all want to have secure APIs and crush the risk of a future data breach.