In the developer docs I've found the option to unrestrict API access. Is there an option to restrict access to the API for everything i.e. nothing is anonymous? Or is there a way to disable the magento API?
Maybe I misunderstand but seems like bots can spam your API endpoint to retrieve a lot of information.
https://devdocs.magento.com/guides/v2.3/rest/anonymous-api-security.html
Update
Am I correct in saying that Magento 1 doesn't allow anonymous access?
using nginx correct way would be to map all API endpoints and configure some access logic.
map $request_uri $api_access {
default 0;
~/(.*)/V1/carts/mine 0; # example to pass?
~/(.*)/async/bulk/V1/customers 1;
~/(.*)/V1/customers(?!/me) 1;
~/(.*)/V1/customers/password 1;
~/(.*)/V1/customers/resetPassword 1;
~/(.*)/V1/customers/isEmailAvailable 1;
~/(.*)/V1/guest-carts/ 1;
~/(.*)/V1/integration/ 1;
~/(.*)/V1/products-render-info 1;
~/(.*)/V1/search 1;
......
......
map every endpoint you like!
}
if ($api_access) {
some logic to log / verify / limit access;
set $foo bar;
rewrite @to_magento;
}
disable guest checkout is also good option, today in online business is better to know your customers are legit.
