How to secure the API?

Question

JSON Web Token

Good morning!
We wrote a mobile application that will interact with our server.
The server is quite simple. It accepts JSON and responds.
There is one nuance ... If some smart guy finds the server address, then he can easily send requests to our server via curl . Since the API is simple, it will fulfill these requests, as long as they are valid.
How can you secure the server?
Heard about JWT. Is this the solution?
A little about the API.
It is written in Koa. It registers users, changes some of their data, and performs various other CRUD-type operations.
This is a new experience for me).
Thank you very much in advance!

Answer 1

Since the API is simple, it will fulfill these requests, as long as they are valid.

Duck this api and should deal with. What is the safety issue? If you are afraid of an influx of requests, put a limit on the token or with something like https://github.com/koajs/ratelimit

Answer 2

There is no protection from this. Only if CSRF makes it difficult, or captcha. https://www.owasp.org/index.php/REST_Security_Chea...