How would you design a secure username and password login flow for an API?

Design a secure password login flow

Explains password verification, hashing, throttling, generic errors, lockout, and safe login telemetry.

1Say itAnswer out loud first

2CompareCompare with Core answer

3RefineRefine with Stronger and Advanced

TL;DR

I would never store plain passwords. The API stores a salted password hash using a password-hashing algorithm designed for credentials. On login, it finds the account, verifies the submitted password against the hash, checks account status, and returns a generic failure message if anything is wrong. If it succeeds, it issues the normal session or token response.

Full answer below

Practice focus

Password hashing, generic failures, rate limiting, lockout, audit signals, token issuance, and safe error responses.

Answer first

Answer path

Core answer first, then checkpoints toward a stronger answer.

Start
Core answer
Start here. This is the direct spoken answer to practice first.
Why this question matters
Password login looks simple, but it combines credential storage, abuse control, token issuance, and user-facing error behavior.
I would never store plain passwords. The API stores a salted password hash using a password-hashing algorithm designed for credentials. On login, it finds the account, verifies the submitted password against the hash, checks account status, and returns a generic failure message if anything is wrong. If it succeeds, it issues the normal session or token response.
Checkpoint
Stronger answer
Optional upgrade with examples, trade-offs, and sharper phrasing.
I would protect the endpoint from guessing and enumeration. Failed login responses should not reveal whether the email exists. The API should rate limit by account, IP, device signal, or a combination, and use lockout or step-up checks after repeated failures. Successful login should reset failed counters where appropriate and record enough audit context for support and security investigation.

Review signals

Use these to catch weak phrasing, shallow reasoning, and risky claims.

Common mistakesCandidateCommon mistakesMistakes that weaken the answer or signal shallow understanding.Open details

Details

Storing passwords with fast hashes or reversible encryption.
Returning user-not-found versus wrong-password details.
No throttling on login attempts.
Logging submitted passwords or issued tokens.

How would you design a secure username and password login flow for an API?

Practice focus

Answer path

Why this question matters

Review signals

Follow-up prompts

Continue practice

Tech stacks

Skill areas

Suggest an improvement