API Lumen Consulting · API access
+27-21-000-0113

API Lumen Consulting

Programming consulting focused on API security, token lifecycles, and access-control design for teams shipping integrations in South Africa.

Request an assessment View consulting paths
API Lumen Consulting (Pty) Ltd is a private company incorporated in South Africa. Registered office: 45, Church Street, 7600 Stellenbosch. CIPC 2018/362240/07 · +27-21-000-0113 · info@apilumen.digital

Myth: bolting OAuth on later is cheaper. Reality: retrofitting scopes, rotation, and audit trails after launch costs more than designing access up front.

Access control is not a checkbox on launch day

Many teams treat API keys and bearer tokens as plumbing. When a partner integration mis-scopes data or a mobile build caches refresh tokens incorrectly, the incident starts in code you never reviewed.

We run structured reviews of gateway rules, scope matrices, and service-to-service auth—mapping what each client may call before you widen production traffic.

Engagements stay advisory unless you ask for scoped implementation; fees and deliverables are agreed after your inquiry.

Overhead view of a desk with keyboard and planning notes for API access design
Network server rack with organized cabling in a data hall

Gateway policies should match how your racks and clusters actually route traffic—not a diagram from a slide deck.

How an API security engagement unfolds

  1. Intake call — You describe endpoints, identity providers, and partner channels. We note regulatory or POPIA-driven constraints on personal data fields.
  2. Threat-aligned review — We trace authentication flows, rate limits, and scope boundaries against realistic abuse cases (credential stuffing, token replay, over-privileged service accounts).
  3. Findings memo — Prioritized gaps with example request paths, not generic “enable MFA” slides.
  4. Optional build slice — If you need hands-on help, we quote a bounded implementation window separate from the assessment fee.

Questions teams ask before booking

Do you sell a fixed SaaS plan?

No. Work is project consulting: assessments, advisory sessions, and optional implementation slices with scope confirmed in writing after inquiry.

Can you audit third-party gateways we already pay for?

Yes. We review configuration exports, policy JSON, and staging behaviour without requiring you to replace the vendor—only to grant read access agreed in the statement of work.

Where are sessions held?

Remote working sessions are standard; on-site working blocks in Stellenbosch or Cape Town can be arranged when travel is included in the quote.