Services

API security and authentication consulting

API Haven Consulting delivers paid programming consulting as defined statements of work — not software subscriptions. Every engagement names deliverables, timeline, and fees before work begins.

API authentication audit

A fixed-scope review of your public and partner-facing APIs. We examine OAuth 2.0 / OpenID Connect flows, API gateway policies, JWT validation, refresh-token storage, and object-level authorization in application code. You receive a written report with severity-rated findings and remediation guidance your team can schedule.

Typical inputs: architecture diagrams, IdP configuration exports, sample traffic logs (redacted), and read access to relevant repositories or IaC.

Authentication design workshop

For teams about to launch a new service or migrate identity providers. Working sessions cover scope models, client types (SPA, mobile, machine-to-machine), token lifetimes, rotation, and failure modes. Output is a decision log and reference sequence diagrams — ready for implementation sprints.

Technical advisory block

Pre-purchased hours for questions that arise during implementation: PKCE edge cases, partner onboarding, key rotation, or gateway plugin behavior. Advisory is remote by default; on-site days in Johor Bahru can be added to a statement of work when needed.

Pricing and payment

Fees are quoted per engagement after a short discovery call. We do not publish fixed price lists because API surfaces vary widely. Invoices state whether Malaysian service tax (SST) applies. Payment is by bank transfer unless otherwise agreed in writing.

Ready to start?

Send an inquiry with a short description of your API stack and the outcome you need (audit, design, or advisory).