API Auth Watch

Auth bugs rarely announce themselves. A route gets registered outside the protected router, a handler decodes a token without verifying it, an object lookup forgets the owner filter, or an error handler starts returning the user object with the 401. Everything still works for the people testing it.

API Auth Watch gives your AI a procedure and a script to catch these. You describe a matrix: which identities may call each endpoint and which must be turned away. The script sends the same read-only request as anonymous, as each role or user you define (tokens from environment variables), with a tampered token it builds itself, and as an alg-none JWT. Each answer is checked against the matrix. It also looks for leaked fields, tokens and stack traces in 401/403 bodies, CORS that trusts any origin with credentials, and missing security headers. Findings are ranked by risk and compared with the last run.

Inside: the skill procedure (build the matrix from your routes or an OpenAPI file, run it, explain failures by risk), a Node.js script with no npm packages that can also draft a config from OpenAPI JSON, references for matrix building, config and risk, starter configs, an offline demo against a deliberately buggy sample API, and test records.

Test only systems you own or are authorised to test. This is a regression checker, not a penetration test. It does not log in for you, covers header-based credentials only, and cannot see business-logic flaws behind a correct status code.