Three things I would check before opening an API to customers
A small pre-launch security pass that catches issues teams often discover later.
Opening an API to customers changes the shape of your attack surface.
It is worth slowing down for one small security pass before the traffic arrives.
1. Authentication is not authorization
A valid token should not automatically mean valid access. Test different users, roles, tenants and resource IDs. Try the requests you expect to fail.
2. Look at the boring endpoints
Security reviews often gravitate toward the obvious “important” endpoints. I also want to see the boring ones: profile updates, file downloads, search, exports, webhooks, password and session operations.
3. Decide what you will log
You do not need to log everything. You do need enough useful security events to answer basic questions later: who authenticated, who changed something important, which privileged action happened, when it happened and from where, where appropriate.
A small habit that helps
Before launch, pick five actions that would be genuinely painful if abused. Trace each one from request to authorization check to data access to logging. It is a small exercise. It can reveal a lot.