> For the complete documentation index, see [llms.txt](https://docs.frends.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.frends.com/docs/frends-6.1.0/security/api-security-features.md). # API Security Features Frends APIs are built with ease of use and security in mind. Frends is committed to providing highly secure and reliable API management services. We use proven technologies, robust practices, and established procedures to ensure your data and services are protected. ## Network Security To ensure all data transmitted to and from the Frends platform is secure, we enforce several network security measures. The Frends Platform is accessible only over HTTPS protocol, which encrypts all traffic and protects it from interception by unauthorized parties. We follow the current best practices, including the use of strong encryption algorithms of at least 128 bits. When connecting to on-premises systems, access is managed via a Frends Agent installed behind your firewall. This Agent communicates with the Frends cloud over a secure, encrypted link using TLS 1.2. Our platform uses a multi-tier architecture that segregates internal application systems from the public internet. All network access is restricted by firewall rules and logged in a secure, centralized system to ensure a controlled and monitored environment. ## Authentication and Access Control Frends provides multiple robust methods to authenticate and authorize callers to your APIs, ensuring that only legitimate clients can access your endpoints. The primary methods supported are API keys and OAuth 2.0 with external authentication provider or Frends built-in private tokens, with options for Basic Authentication and client certificates also available. In Frends, each authentication and authorization method is Environment or Agent Group specific and its access rights are defined by one or more API Policies. An API Policy is a collection of rules that grant access to specific URL paths and HTTP methods, allowing for granular control over what each method can do. You can also configure request throttling on a per-identity basis to prevent abuse. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.frends.com/docs/frends-6.1.0/security/api-security-features.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.