Security teams can now investigate six token risks directly at the endpoint level, making it easier to prioritize findings and take action across their API estate.

APIs depend on tokens to authenticate requests and control access. But weak signing algorithms, excessive token lifetimes, exposed credentials, and inadequate expiry enforcement can undermine that protection.

Identifying these weaknesses is only the first step. Security teams also need to know which endpoints are affected, understand the associated risks, and give application owners clear guidance on remediation.

Thales’s Imperva API Security now surfaces token risk detections directly in API Inventory. Previously available in the account-level Token Risk Report, these findings are now tied to individual endpoints, bringing investigation and remediation closer together.

Why endpoint-level token risk matters

Thales’s 2026 Token & Authentication Risk Report highlights the scale of the challenge. The report found that sensitive data exposure in JWTs increased from 46.0% to 49.8% of token-risk detections year over year. It also found that the share of endpoints accepting expired tokens increased from 5.0% to 8.5%.

Nearly 40% of endpoints with token risks had two or more authentication risks, showing why teams need to understand how weaknesses can overlap.

Previously, security teams had to cross-reference the account-level report with API Inventory to locate affected endpoints. With the new enhancement, they can investigate these findings directly where they already manage API risks.

What’s new in API Inventory?

Token risks now appear as named values in the existing API Risks column, with three practical improvements.

• Filter by risk: Find endpoints associated with a specific issue, such as Expired Token Acceptance.
• Investigate at the endpoint level: Open an endpoint’s detail drawer to view the risk name, endpoint-specific description, and first and last detected dates.
• Access remediation guidance: Understand the finding and the recommended next steps without exposing the underlying tokens or credentials.

The result is a more direct workflow: identify affected endpoints, investigate the issue, and coordinate remediation without translating account-level findings into a separate endpoint list.

Six token risks. One place to investigate them.

Thales’s Imperva API Security now surfaces six token and authentication risks directly in API Inventory.

Token risk	What it means	Why it matters
JWT Weak/Missing Algorithm	A JWT uses a weak signing algorithm or lacks an appropriate algorithm.	Depending on the implementation, token integrity may be undermined, potentially allowing forgery.
JWT Excessive TTL	A token remains valid longer than necessary.	A stolen token may remain usable for an extended period.
JWT Sensitive Data Exposure	Sensitive information is present in JWT claims.	JWT payloads are encoded, not inherently encrypted, and may be readable by anyone who obtains the token.
Auth Details in Path Params	Credentials or tokens are passed in URL path parameters.	URLs may be captured in logs, proxies, and browser history.
Expired Token Acceptance	An API accepts a token after its expiry.	Access may persist beyond the intended token lifetime.
Basic Auth Token Exposure	Reusable Basic Authentication credentials are exposed in requests.	Captured credentials may be replayed until they are changed or invalidated.

Together, these detections help teams investigate weaknesses in token integrity, lifetime, data confidentiality, credential handling, and expiry enforcement.

From finding to fix

The enhancement turns token risk findings into a more actionable endpoint-level workflow.

1. Scope the issue. Filter API Inventory by a specific token risk to identify affected endpoints.
2. Prioritize. Consider endpoint exposure, data sensitivity, and other risks associated with the same endpoint.
3. Route for remediation. Share the endpoint-specific description and remediation guidance with the responsible application or engineering team.
4. Verify. Review subsequent detection activity after the fix is deployed. First and last detected dates provide useful context, but teams should validate remediation against relevant traffic and other available evidence.

By bringing these steps closer together, Imperva helps security teams move from identifying an authentication weakness to coordinating a response, while making it easier to investigate multiple risks affecting the same endpoint.

Securing the authentication layer behind agentic AI

As AI agents increasingly interact with business applications, internal services, and third-party systems, APIs remain a critical part of the security foundation. The Model Context Protocol (MCP) provides a standardized way for AI applications to connect with tools and external data sources, making secure authentication and credential handling important considerations for agentic workflows.

This is where endpoint-level token risk detection becomes particularly relevant.

Aligning with OWASP MCP01: Token Mismanagement & Secret Exposure

OWASP’s MCP Top 10 Identifies MCP01: Token Mismanagement & Secret Exposure as a key security risk for MCP-enabled systems.

Thales’s Imperva API Security’s six token risk detections align with authentication and credential-handling concerns relevant to MCP01:

• Weak or missing JWT algorithms can undermine token integrity.
• Excessive token lifetimes can extend the window in which a compromised token remains useful.
• Sensitive data in JWT claims can expose information if a token is obtained by an unauthorized party.
• Authentication details in URL paths can increase the risk of credential exposure through logs and intermediary systems.
• Acceptance of expired tokens can indicate that token expiry is not being enforced as intended.
• Exposed Basic Authentication credentials can create opportunities for credential reuse and replay.

By surfacing these risks at the endpoint level, Imperva helps security teams investigate authentication weaknesses in APIs that support agentic workflows, where those endpoints are discovered and monitored by the platform.

This is a focused contribution to MCP security, not a claim of comprehensive MCP protection. Token risk detection alone does not discover every MCP server, prevent prompt injection, enforce least-privilege permissions, or determine whether an agent’s actions are legitimate. It provides actionable insight into an important part of the security foundation on which these systems depend.

As organizations adopt MCP and more autonomous workflows, understanding and remediating authentication weaknesses across their API estate becomes increasingly important.

Make token risks easier to act on

Security teams need more than a list of potential problems. They need to connect findings with the affected endpoints, the teams responsible, and the steps required to address them.

With six token risks now surfaced directly in Thales’s Imperva API Security’s API Inventory, teams can filter findings, investigate endpoint-specific details, and access remediation guidance in one place.

The goal is simple: make token risks easier to find, easier to understand, and easier to act on – one endpoint at a time.

Learn more: Read Imperva’s 2026 Token & Authentication Risk Report to explore the authentication risks affecting APIs today.

The post Strengthening API and MCP Security Through Token Risk Detection with Thales Imperva API Security appeared first on Blog.

Introduction

Quick answer: No single tool secures an API. API security is a layered discipline. Secure-coding analyzers and SCA scanners catch code and dependency flaws; DAST tests running APIs; API gateways and IAM enforce authentication and rate limits; a WAF blocks known attack patterns; bot management stops automated abuse; and runtime API security adds continuous discovery and catches business-logic threats like BOLA that other tools miss. This guide maps these API security tools to seven risk domains so you can see your coverage—and your gaps.

APIs power mobile apps, partner integrations, cloud microservices, SaaS platforms, and AI services; they are the business.

According to Imperva’s State of API Security report, API traffic now accounts for over 71% of all web traffic. As APIs have exploded in number and importance, so has the challenge of securing them.

When organizations look for “API security,” they quickly face a confusing mix of tools:

• Secure coding analyzers
• Dependency scanners
• CI/CD testing platforms
• Network firewalls
• Web application firewalls (WAF)
• API gateways
• Identity and access management (IAM) systems
• Bot management platforms
• Dedicated API security solutions

Each tool does protect APIs, but only in its own narrow way.

API security is not a single product. It is an architectural discipline that spans the entire API lifecycle: from design to code, deployment, runtime, and monitoring.

This blog cuts through the noise. It shows exactly which risks each security component addresses, and where the gaps remain, so you can build a complete, layered defense.

The API Risk Landscape

API risks don’t come from one place. They appear at every stage of the software lifecycle. Here are the seven core risk domains you must understand:

Why This Landscape Matters

Real breaches almost always happen when risks from multiple domains line up.

Example:

A valid token (authentication risk) + excessive data exposure (design risk) + an exposed endpoint (configuration risk) + automated enumeration (abuse risk) = a major breach.

No single tool covers every domain. That’s why a layered approach is essential.

Security Components in the API Security Stack

Enterprise API protection never comes from one product. It’s a combination of tools working in different layers. Here’s what each major component does:

Mapping Security Components to API Risk Domains

Here’s a clear, at-a-glance view of what each component covers:

Security Component	Design	Code	Supply Chain	Config	Auth	Abuse	Logic
SAST
SCA
DAST
WAF
API Gateway
IAM
Bot Manager
Runtime API Security

Legend

= Strong / primary coverage

= Partial or indirect coverage

= No meaningful coverage

What Runtime API Security delivers

• Design: Detects undocumented APIs and excessive data exposure (but doesn’t fix the original spec).
• Code: Spots exploit attempts in live traffic (but doesn’t scan source code).
• Supply Chain: No visibility into libraries or CVEs.
• Configuration: Identifies exposed or misbehaving endpoints.
• Authentication & Access: Catches misuse and authorization anomalies.
• Automation & Abuse: Detects patterns (often works alongside bot management).
• Business Logic: This is its superpower, behavioral analysis, object-level authorization monitoring, and detection of low-and-slow attacks that no other tool sees.

Quick takeaway on Runtime API Security

It shines brightest in Business Logic (its real superpower) and gives helpful visibility across most other domains, but it still works best alongside the other tools. Solutions like Imperva API Security from Thales are built specifically for this layer.

Final Thought

Building Your Layered API Security Strategy

API security isn’t about buying one magic product. It’s about understanding the full risk picture and picking the right tool for each layer.

Next Steps

1. Map your current tools against the 7 risk domains using the matrix above.
2. Spot the gaps—especially in Business Logic & Behavioral Risks, where the most damaging attacks hide.
3. Layer specialized coverage where needed. Imperva offers a strong, integrated portfolio, including industry-leading Runtime API Security, WAF, Bot Management, and API Gateway capabilities, that helps close multiple gaps with one cohesive platform.
4. Take the next step today. Review your API inventory, run a quick gap analysis, or contact your security team / Imperva/Thales’s representative for a tailored assessment.

Organizations that treat API security as an architectural discipline, not a checkbox, are the ones that move fast and stay secure.

Frequently Asked Questions

What tools are used for API security?

There is no single API security tool. A complete stack layers several: secure-coding analyzers (SAST) and software composition analysis (SCA) for code and dependency flaws, DAST for testing running APIs, API gateways and IAM for authentication and rate limiting, a WAF for known attack patterns, bot management for automated abuse, and runtime API security for discovery and business-logic threats such as BOLA.

Is a WAF enough to secure APIs?

No. A WAF blocks known attack patterns at the edge, but it cannot see business-logic abuse like Broken Object Level Authorization (BOLA) and does not discover shadow or undocumented APIs. Imperva’s research notes that traditional tools such as a WAF struggle to detect API business-logic abuse, so runtime API security is needed alongside it.

What is runtime API security?

Runtime API security continuously discovers every API—including shadow and deprecated endpoints—monitors live traffic, and uses behavioral analysis and object-level authorization checks to catch business-logic attacks, including the low-and-slow threats other tools miss.

What are the main API security risks?

API risk spans seven domains across the lifecycle: design and specification, code-level, third-party and supply chain, deployment and configuration, authentication and access, automation and abuse, and business logic and behavioral risks. Most breaches happen when risks from several domains line up at once.

The post API Security Demystified: Which Tools Actually Protect Your APIs (And Where the Gaps Are) appeared first on Blog.