API Authentication Tester

Server assisted API Testing

Send the same request with and without credentials (or with a tampered token) to verify that the API enforces authentication correctly, returns proper 401/403 codes and safe error bodies.

Privacy: Processing happens in your browser where possible. Network checks are relayed through the Mutqan backend and are not stored.

How does API authentication with tokens work?

Most APIs authenticate each request with a credential sent in a header: a bearer token (often a JWT issued by an OAuth 2.0 flow), an API key, or Basic credentials over TLS. The server validates it on every call — signature, expiry, audience, scopes — and answers 401 when it is missing or invalid and 403 when it is valid but not allowed. Testing authentication means trying each of those paths, not only the happy one.

Security note: Broken authentication and broken object-level authorization top the OWASP API Security list. Test that an expired, tampered or other-user token is refused, and that every object id is checked against the caller — not only the endpoint.

Read the guide: What is a JWT? JSON Web Tokens Explained

The matrix covers the two 401 branches and the valid path; whether a valid but unauthorised caller gets 403 has to be checked separately with another user’s or role’s token.
Question 1: Is a credential sent where and how the API expects it?The right header or query parameter, the right scheme, a non-empty value

  • Answer: No

    Outcome: 401Rows: No credentials, Empty token, Empty key, Wrong scheme, Key in the wrong place

  • Answer: Yes

    Question 2: Is it valid?Signature, expiry and audience, or the key or password lookup

    • Answer: No

      Outcome: 401Rows: Tampered token, Tampered key, Wrong password, Empty password

    • Answer: Yes

      Question 3: Is this caller allowed to do this?Scopes, and every object id checked against the caller

      • Answer: No

        Outcome: 403Check separately with another user’s or role’s token; the tool would mark “Valid credentials” FAILNot in the matrix

      • Answer: Yes

        Outcome: 2xxRow: Valid credentials

Row names as the tool prints them; each run sends five rows for the chosen type. Every row except “Valid credentials” passes with 401 or 403 and fails with 2xx or 5xx; a 401 without WWW‑Authenticate or a leaky error body gets a warning.

How to use API Authentication Tester

  1. Enter the endpoint and method, then the valid credentials.
  2. Optionally add extra headers or a request body.
  3. Run the matrix and review the table: PASS means the API behaved correctly for that variant.
  4. Expand a row to inspect the full response, and copy the Markdown summary into your findings.

API Authentication Tester features

  • Sends the same request with valid, missing, tampered, empty and wrongly-placed credentials
  • Supports Bearer tokens, Basic auth and API keys in headers or query parameters
  • Verdicts per variant with expected vs actual status, plus checks for WWW-Authenticate and leaky error bodies
  • Expandable full response for every variant
  • Markdown summary for reports; credentials are never stored

API Authentication Tester example

Bearer-protected endpoint

Input:

GET https://httpbin.org/bearer
Bearer token: demo-token-1234567890

Output:

Valid credentials  200  PASS Accepted (200).
No credentials     401  PASS Rejected with 401.
Tampered token     200  FAIL accepted — authentication is NOT enforced for this case.
Empty token        401  PASS
Wrong scheme       401  PASS

Frequently asked questions about API Authentication Tester

What does the matrix send?

The same request with (1) your valid credentials, (2) no credentials, (3) tampered credentials, (4) empty credentials and (5) the credentials in the wrong scheme or location. Each response is compared with the expected 2xx/401/403.

What does a FAIL mean?

A variant without valid credentials was accepted (2xx), valid credentials were rejected, or malformed credentials caused a 5xx. Warnings flag details such as a missing WWW-Authenticate header or verbose error bodies.

Are my credentials stored?

No. They are used for this run only and never leave the page except inside the requests you asked to send.

Can I test API keys in the query string?

Yes — choose API key, set "Add to: Query parameter". The matrix also tries sending the key in the other location.

Technical notes

Tampering flips one character near the end of the secret so that signatures and lookups fail while the format stays plausible. Bodies of 401/403 responses are scanned for stack-trace patterns and unusual size, which often indicate information leakage.

References