A service application programming interface (API) invoking method where a security method applied to an API exposing function entity is updated from an original security method to a new security method, and where the security method of the API exposing function entity is used for communication between the API exposing function entity and an invoker. The method includes: obtaining, by the invoker, a new security method of the API exposing function entity; and sending, by the invoker, a first invoking request to the API exposing function entity using the new security method, where the first invoking request includes a name of a service API, and where the first invoking request is used to invoke the service API.