Sensitive Business Flows & Bot Abuse — API Security in Depth

Some attacks use your API exactly as designed, just at scale: credential stuffing on login, scalpers buying limited stock, fake accounts farming referral credit, scraping prices. Identify sensitive flows and add flow-level controls: device and behavioral signals, app attestation, CAPTCHA/proof-of-work only when risky, per-account and per-payment-instrument limits, queueing/lotteries for drops, velocity checks, and breached-password checks at login.

Flows and controls

Flow	Abuse	Controls
Login	Credential stuffing	Breached-password checks, rate limits per account/IP/ASN, MFA/passkeys, risk-based step-up
Signup	Fake accounts	Email/phone verification, device signals, velocity limits
Checkout of limited items	Scalping bots	Queue/lottery, per-customer limits, attestation
Referral / promo	Self-referral farms	Payment-instrument/device uniqueness, delayed rewards
Search / catalog	Scraping	Rate limits, pagination caps, anomaly detection
Reviews / posts	Spam	Reputation, content filters, throttles for new accounts

Python (risk-based login)

async def login(body: LoginIn, ctx: RequestContext):
    await limiter.hit(f"login:acct:{body.email.lower()}", limit=10, window=900)
    await limiter.hit(f"login:ip:{ctx.ip}", limit=50, window=900)
    user = await verify_password(body.email, body.password)       # constant-time; generic error
    risk = await risk_engine.score(user, ctx)                      # new device, ASN, impossible travel
    if risk.high:
        return challenge(user, method="passkey_or_otp")
    return issue_session(user)

Common pitfalls

Global IP rate limits only (botnets rotate IPs).
CAPTCHAs on every request (UX cost, solved by farms).
Paying referral rewards instantly.

Key points

Identify sensitive flows explicitly
Layer signals: account, device, IP/ASN, payment instrument
Step-up only when risky

Flows and controls

Common pitfalls

Key points

Practice questions