The $1.9 trillion Wells Fargo is migrating from its token-based API to the OAuth 2 API, which adds “an additional layer of security by requiring a digital certificate,” Wells Fargo said in an alert sent to developers today.

Those using Wells Fargo’s API have until Oct. 31, when the token API will be retired, to make the migration, the alert noted.

OAuth 2 is an industry-standard protocol for authorization, considered by security experts to be a best practice for defending against API attacks. APIs are code that supports integration between apps and services. The app will “call” an API to activate a particular service or function, an approach frequently used by mobile devices or web pages to embed financial functions in apps.

A token API relies on a unique identifier of an application requesting access to a service. OAuth 2.0 uses tokens, with the digital certificate adding an extra layer of security. Certificates are based on public-key cryptography and are issued by certificate authorities, an approach called “public key infrastructure” or PKI. A simple way to think about it, suggested by digital security vendor AET, is that digital certificates are like using an official document to identify someone versus just a name or signature.

Wells Fargo’s announcement comes at a time when attacks seek to exploit vulnerabilities in APIs.

Nearly every organization queried reported an API security incident in the last year, according to Salt Security’s State of API Security report for Q3, 2021, released last week. In addition, 11% of Salt Security customers reported their APIs were attacked more than 500 times every month. The report combines empirical data from Salt Security customers with the survey responses of more than 200 global respondents from a variety of industries. The Palo Alto, Calif.-based company specializes in API security and counts Finastra and City National Bank among its customers.

Use of API calls are on the rise, growing 141% from December to June, the report found. By comparison, malicious traffic increased 348% during the same time period, with 12.22 million attack calls per month in June 2021.

Developers can find more information on how to upgrade to the new API in the how-to on the Wells Fargo Gateway.