API Security Best Practices Guide

I am building a proof-of-concept automation script for a future video-calling product and need a seasoned API security professional to review the overall design before I write a single line of code. Because I do not have permission to probe the live app that inspired this idea, we will keep the work strictly theoretical and best-practice-oriented.

My immediate goals are to
• understand how to inspect and log GET and POST traffic safely during development
• design a referral flow that unlocks extra features or free usage for successful invites without opening abuse vectors
• integrate Google OAuth sign-in while avoiding the common pitfalls around token handling, refresh logic, and scope creep

Please focus on secure architecture patterns, recommended tools (e.g., Postman, OWASP ZAP, Burp Suite, Wireshark), and practical checklists I can follow later when I do have permission to run tests.

Deliverables
• A concise written guide (Markdown or PDF) covering the three areas above, including illustrative sequence diagrams or sample cURL/Postman calls where useful
• A risk matrix highlighting common attack surfaces for referral systems and OAuth flows, with mitigation steps
• A short call or recorded walkthrough (30–45 min) to clarify questions that arise after I read the material

Acceptance criteria: the guide must be actionable for a beginner-to-intermediate developer, cite authoritative sources (OWASP, Google Identity docs), and map each recommendation back to the specific goals stated.