API Security Events and Communities
A map of the places where API security practice is discussed and shared, from local meetups to the working groups that write the specs. Dates and formats change, so check each organizer's site.
API security sits between several communities: API design and product people, application security, and identity. Each has its own events. You get the most from following a little of each.
Which kinds of events are worth it?
| Type | What you get | Examples |
|---|---|---|
| API-focused conferences | Design, governance, API programs, security tracks | Regional and international API conferences |
| Identity conferences | OAuth, OIDC, CIAM, workforce identity | Identiverse, European Identity and Cloud Conference |
| Open-format workshops | Deep protocol discussion | Internet Identity Workshop, OAuth Security Workshop |
| Application security events | Attacks and defenses, testing | OWASP Global AppSec, local OWASP chapters |
| Internet and network conferences | Policy, infrastructure, regional digital services | National internet days, operator forums |
| Standards meetings | Influence and early insight | IETF meetings, OpenID Foundation workshops |
How do I follow standards work without attending?
Join the mailing lists and read meeting materials.
The IETF OAuth working group's list and datatracker pages show every draft and discussion. The OpenID Foundation publishes working group drafts and holds open calls. See identity standards bodies and communities.
What should a team bring back from an event?
One change to try, written down and assigned.
A short internal summary with links to recordings, plus a concrete action, makes the trip pay off. For a structured internal program, see planning API security training, and for the content itself, the OWASP API Top 10 in practice.
Communities online
Developer forums for your gateway or identity platform, OWASP project channels, and the public discussion around specifications all help. On X (Twitter), searches such as #APISecurity and #OAuth surface current discussion; links are on the home page.
Common questions
Are there API events in the Nordic countries?
Yes. Stockholm, Copenhagen, Oslo and Helsinki all have active developer, API and security communities, and the region hosts international API and internet conferences. Search current meetup listings for your city.
What is the best free way to learn API security?
Read the OWASP API Security Top 10, the OAuth 2.0 Security Best Current Practice (RFC 9700) and RFC 8725 on JWTs, then try the attacks in a lab application. Local OWASP chapter meetings are free and often cover API topics.