What it is
API Shield secures your APIsAPIApplication Programming Interface — how software talks to other software, e.g. a mobile app calling a server. specifically. It automatically discovers every API endpoint from live traffic, enforces that requests match your OpenAPI schemaOpenAPIA standard file format that describes an API's structure, so tools can automatically validate requests against it., requires client certificates (mTLSmTLSMutual TLS — both the client and the server present certificates to prove who they are; strong two-way authentication.) for sensitive calls, and detects abnormal usage — closing the gaps that traditional web security misses.
Why it helps the client
- Full visibility — automatically discovers and inventories all API endpoints, including shadow APIs.
- Positive security — schema validation rejects malformed or malicious calls before they hit origin.
- Strong auth — mTLS ensures only trusted clients (mobile apps, partners) can call sensitive APIs.
- Stops API-specific abuse: broken object-level authorization, scraping, and volumetric attacks.
Why they'd want it
- APIs are now the #1 attack vector — this protects the crown jewels.
- Zero-trust and compliance for machine-to-machine traffic.
- Surface shadow and undocumented APIs they didn't know were exposed.
🔬 How it actually works
- API Shield is positive security for APIsAPIApplication Programming Interface — how software talks to other software, e.g. a mobile app calling a server.: it discovers endpoints from live traffic (including undocumented 'shadow' APIs), inventories them with request volume and auth status, and enforces that requests conform to your OpenAPI schemaOpenAPIA standard file format that describes an API's structure, so tools can automatically validate requests against it. — rejecting wrong types, extra fields, or bad methods before originoriginYour own web server or host where your website actually lives. Cloudflare sits in front of it..
- mTLSmTLSMutual TLS — both the client and the server present certificates to prove who they are; strong two-way authentication. issues and validates client certificates so only trusted clients — your mobile app, named partners — can call sensitive endpoints, giving strong machine-to-machine authentication a generic WAFWAFWeb Application Firewall — inspects web requests and blocks malicious ones (like SQL injection and XSS) before they reach your site. can't.
- Additional layers include JWT/token validation, Sequence Analytics for abuse and business-logic attacks, GraphQL malicious-query protection, and APIAPIApplication Programming Interface — how software talks to other software, e.g. a mobile app calling a server.-specific rate limiting.
- It complements the WAFWAFWeb Application Firewall — inspects web requests and blocks malicious ones (like SQL injection and XSS) before they reach your site.: the WAF blocks known-bad patterns (negative security); APIAPIApplication Programming Interface — how software talks to other software, e.g. a mobile app calling a server. Shield only allows known-good, schemaschemaA definition of exactly what a valid request looks like; validation rejects anything that doesn't match.-valid, authenticated calls (positive security).
📖 Key terms on this page hover any underlined term anywhere on the site for its definition
- mTLS
- Mutual TLS — both the client and the server present certificates to prove who they are; strong two-way authentication.
- API
- Application Programming Interface — how software talks to other software, e.g. a mobile app calling a server.
- OpenAPI
- A standard file format that describes an API's structure, so tools can automatically validate requests against it.
- schema
- A definition of exactly what a valid request looks like; validation rejects anything that doesn't match.
- origin
- Your own web server or host where your website actually lives. Cloudflare sits in front of it.
- WAF
- Web Application Firewall — inspects web requests and blocks malicious ones (like SQL injection and XSS) before they reach your site.
Live demo walkthrough
5 stepsScreens below are annotated recreations of the Cloudflare dashboard. The numbered orange pin marks exactly where to click.
Select the website
Websites
Select a website to manage its configuration.
👉 Do this
Open the site that serves your APIs.
💬 Say this
“Most modern traffic is API traffic — let's secure it specifically, beyond the general WAF.”
Open Security → API Shield
Security
API Shield
👉 Do this
Expand Security and click API Shield.
💬 Say this
“API Shield is purpose-built for APIs. The general WAF stops generic attacks; this understands your API's structure.”
Show endpoint discovery
Security
API Shield
👉 Do this
Point to the discovered endpoints inventory with per-endpoint traffic.
💬 Say this
“API Shield automatically discovers every endpoint from real traffic — including shadow APIs teams forgot were live. Here's the inventory with request volume, so we can see exactly what's exposed.”
Enforce schema & mTLS
Security
API Shield
👉 Do this
Upload the OpenAPI schema; add mTLS on the most sensitive endpoints.
💬 Say this
“We upload the OpenAPI schema and Cloudflare rejects anything that doesn't match — wrong types, extra fields, bad methods. For the crown-jewel endpoints we add mTLS, so only our mobile app's client certificate can even call them.”
Catch violations in Events
Security
Events
👉 Do this
Open Events and point to the API Shield schema-violation block.
💬 Say this
“The instant a request breaks the contract, it shows up here as an API Shield schema violation — blocked before it ever reached the origin. This is positive security in action: we don't guess what's malicious, we allow only what's valid.”