domains / families / security / api-auth-and-jwt-abuse

api-auth-and-jwt-abuse

separate

API authentication and JWT abuse playbook. Use when testing bearer tokens, API keys, claim trust, header spoofing, rate limits, and API auth boundary weaknesses.

When to use

• testing bearer tokens
• testing API keys
• claim trust
• header spoofing
• rate limits
• API auth boundary weaknesses
• token trust boundaries
• claim misuse

When not to use

• GraphQL batching and hidden parameters
• default credential and brute-force planning
• full JWT and OAuth depth
• OAuth or OIDC configuration flaws
• credentialed browser reads
• origin trust bugs

Skill page

Source