> authorization

Hmm. Is authorization maybe very app specific? Did you mean authentication?:

Basic Authentication and API keys and HTTPS seems popular. E.g. Stripe: https://stripe.com/docs/connect/authentication#api-keys, and Chargebee (they deal with tons of money).

I like this article: https://www.vinaysahni.com/best-practices-for-a-pragmatic-re... — except that I use only POST and GET, never PUT, DELETE etc. And name the endpoints like:

    POST  /-/create-page            controllers.PageController.createPage
    POST  /-/pin-page               controllers.PageController.pinPage
    POST  /-/unpin-page             controllers.PageController.unpinPage
    POST  /-/reply                  controllers.ReplyController.handleReply

    GET   /-/load-draft-and-guidelines controllers.EditController.loadDraftAndGuidelines
    GET   /-/load-draft-and-text    controllers.EditController.loadDraftAndText
    POST  /-/edit                   controllers.EditController.edit

then one knows what and endpoint does, by just looking at the URL path. Won't also need to ask: "But which method?"

Also, most people that actually design APIs, seem to put the API version in the URL, like `/api/v1/...`.