If someone knows the url for my API (which is accessible over the internet), can't he just bypass the security features that I've set up on EDGE? How would I tackle this scenario?

[akoo]

Couple of options here:

1) API is only accessible on private network

2) basic auth at the least, ideally token-based auth (e.g., OAuthv2) to access API

3) user-level credentials to access API

4) 2-way SSL with backend

Those are the big ones. You can surely use combinations of the above for increased security.

[#2]

Good question

[anilsr]

@Samarth , Please see similar question asked here.