Extend Identity Security to APIs