SSL/TLS

SSL/TLS — Secure Sockets Layer and its successor Transport Layer Security — is the cryptographic protocol that encrypts data as it moves across a network. TLS, standardized by the IETF and now at version 1.3 in RFC 8446, authenticates the server (and optionally the client), negotiates strong ciphers, and guarantees that traffic cannot be read or tampered with in transit. When you see HTTPS in front of an API URL, TLS is what is doing the work.

• Encryption in transit - Turns readable request and response bodies into ciphertext so credentials, tokens, and payloads are safe on the public internet.
• Server authentication via certificates - X.509 certificates, issued by a trusted CA, let a client verify it is talking to the real host and not an impostor.
• Mutual TLS (mTLS) - Optional client certificates authenticate the caller as well as the server, a common pattern for high-trust, service-to-service and B2B API traffic.
• Protocol versioning - TLS 1.2 and 1.3 are the safe baselines; SSL and early TLS versions are deprecated and should be disabled outright.

In practice, TLS is the non-negotiable floor for any API worth trusting: HTTPS-only endpoints, valid and unexpired certificates, and modern cipher suites are among the first things I check when scoring a provider. It underpins the rest of the security stack — OAuth tokens, API keys, and SSH-based deployment all assume the transport itself is already encrypted — and in the agentic turn, where machines negotiate connections without a human in the loop, certificate validity and mTLS become table-stakes signals of whether an API can be trusted at all.