I recently slightly updated my older article about API security best practices. All the things I wrote about more than two years ago are still relevant today. You can check the article here: https://curity.io/resources/learn/api-security-best-practices/