API Authentication Tester

Server assisted API Testing

Send the same request with and without credentials (or with a tampered token) to verify that the API enforces authentication correctly, returns proper 401/403 codes and safe error bodies.

Privacy: Processing happens in your browser where possible. Network checks are relayed through the Mutqan backend and are not stored.

How to use API Authentication Tester

  1. Enter the endpoint and method, then the valid credentials.
  2. Optionally add extra headers or a request body.
  3. Run the matrix and review the table: PASS means the API behaved correctly for that variant.
  4. Expand a row to inspect the full response, and copy the Markdown summary into your findings.

API Authentication Tester features

  • Sends the same request with valid, missing, tampered, empty and wrongly-placed credentials
  • Supports Bearer tokens, Basic auth and API keys in headers or query parameters
  • Verdicts per variant with expected vs actual status, plus checks for WWW-Authenticate and leaky error bodies
  • Expandable full response for every variant
  • Markdown summary for reports; credentials are never stored

API Authentication Tester example

Bearer-protected endpoint

Input:

GET https://httpbin.org/bearer
Bearer token: demo-token-1234567890

Output:

Valid credentials  200  PASS Accepted (200).
No credentials     401  PASS Rejected with 401. Note: no WWW-Authenticate header.
Tampered token     200  FAIL accepted — authentication is NOT enforced for this case.
Empty token        401  PASS
Wrong scheme       401  PASS

Frequently asked questions about API Authentication Tester

What does the matrix send?

The same request with (1) your valid credentials, (2) no credentials, (3) tampered credentials, (4) empty credentials and (5) the credentials in the wrong scheme or location. Each response is compared with the expected 2xx/401/403.

What does a FAIL mean?

A variant without valid credentials was accepted (2xx), valid credentials were rejected, or malformed credentials caused a 5xx. Warnings flag details such as a missing WWW-Authenticate header or verbose error bodies.

Are my credentials stored?

No. They are used for this run only and never leave the page except inside the requests you asked to send.

Can I test API keys in the query string?

Yes — choose API key, set "Add to: Query parameter". The matrix also tries sending the key in the other location.

Technical notes

Tampering flips one character near the end of the secret so that signatures and lookups fail while the format stays plausible. Bodies of 401/403 responses are scanned for stack-trace patterns and unusual size, which often indicate information leakage.