API Security Hub
Learn API security in five stages: foundations (authentication, tokens and OAuth), design and policy, build and test, run and defend, and program. This page lists all 18 PlayCISO API security tools and labs (10 hands-on labs) in that order, with the OWASP API Security Top 10 2023 items each one covers, its level and whether it is free or Pro. Everything runs in your browser on synthetic data.
Short on time? Score yourself with the API Security Posture Score, then turn the gaps into a plan with the API Security Roadmap Builder.
Foundations: auth, tokens and OAuth
How APIs know who is calling. Most API2 Broken Authentication findings start here.
- Lab·Starter · Rookie / Pro / Elite
API & Service Auth Lab
Pick API key vs client credentials vs mTLS vs workload identity, and spot leaked or over-scoped credentials.
API2 Broken authenticationAPI8 MisconfigurationPro3 free runs with a free account, then Pro.
- Lab·Starter · Rookie / Pro / Elite
OAuth Flow Lab
Choose the right OAuth 2.0 grant per app: authorization code with PKCE, client credentials, device code.
API2 Broken authenticationPro3 free runs with a free account, then Pro.
- Tool·Starter
JWT Decoder
Decode a JSON Web Token, read its claims in plain English and verify the signature in your browser.
API2 Broken authenticationPro3 free runs with a free account, then Pro.
- Lab·Practitioner · Rookie / Pro / Elite
JWT Attack & Defense Lab
Forge alg:none tokens, crack weak HMAC secrets, try key confusion, then harden validation.
API2 Broken authenticationPro3 free runs with a free account, then Pro.
- Lab·Practitioner · Rookie / Pro / Elite
Token Lifecycle Lab
Triage OAuth and OIDC token setups: lifetimes, refresh rotation, reuse detection, storage and revocation.
API2 Broken authenticationPro3 free runs with a free account, then Pro.
- Lab·Practitioner · Rookie / Pro / Elite
OAuth Consent Lab
Judge third-party app consent requests: over-scoping, offline access, bad redirect URIs, admin scopes.
API2 Broken authenticationPro3 free runs with a free account, then Pro.
- Lab·Advanced · Rookie / Pro / Elite
mTLS Handshake Lab
Diagnose why client-certificate authentication fails between services and pick the right fix.
API2 Broken authenticationAPI8 MisconfigurationPro3 free runs with a free account, then Pro.
Design and policy
Write down what good looks like, then check specifications against it before code exists.
- Generator·StarterNew
API Security Policy Builder
Answer 8 questions and get a 17-section API security policy mapped to the OWASP API Top 10 2023.
API1–API10 (all)Free · Pro exportFree: the policy, coverage table, Markdown and print/PDF. Pro: the policy pack (standards appendix and exception form).
- Tool·PractitionerNew
OpenAPI Spec Gap Analyser
Paste an OpenAPI 3.x or Swagger 2.0 spec and get severity-ranked security gaps with fixes.
API1 BOLAAPI2 Broken authenticationAPI3 Object property level authZAPI4 Resource consumptionAPI5 BFLAAPI8 MisconfigurationAPI9 InventoryFree · Pro exportFree: the analysis, score and OWASP summary. Pro: CSV and Markdown export of every finding.
- Checklist·Practitioner
SSRF Defense Checklist
Score your server-side request forgery controls: allow-lists, metadata blocking, redirects, egress.
API7 SSRFPro3 free runs with a free account, then Pro.
Build and test
Catch property-level exposure and leaked keys in review and test.
- Lab·Practitioner · Rookie / Pro / EliteNew
API Data Exposure Lab
Review API pull requests for excessive data exposure and mass assignment, pick the fix, see it applied.
API3 Object property level authZFreeFree, including the Markdown review checklist.
- Tool·Starter
Secret Scanner
Find leaked API keys, tokens and private keys in pasted code, config and logs, with rotation guidance.
API2 Broken authenticationPro3 free runs with a free account, then Pro.
Run and defend
Gateway rules, rate limits, inventory and incident response for APIs in production.
- Lab·Practitioner · Rookie / Pro / EliteNew
API Gateway Config Lab
Configure a simulated gateway, replay attack and real traffic, and see which rule decided each request.
API2 Broken authenticationAPI4 Resource consumptionAPI5 BFLAAPI8 MisconfigurationFreeFree, including the JSON export of your config.
- Lab·Practitioner · Rookie / Pro / EliteNew
Rate-Limit & Abuse Tuner
Tune limits per endpoint and identity against a 24-hour trace with stuffing, scraping and SMS pumping.
API4 Resource consumptionAPI6 Sensitive business flowsFreeFree, all three levels and the debrief.
- Lab·Practitioner · Rookie / Pro / EliteNew
Shadow API Discovery Lab
Find shadow and zombie APIs in gateway logs, certificates, JS bundles and mobile traffic, then act.
API9 InventoryAPI8 MisconfigurationFreeFree, including the inventory export.
- Generator·Starter
Leaked Credential Response
An ordered runbook for a leaked API or cloud key: contain, rotate safely, investigate, prevent.
API2 Broken authenticationPro3 free runs with a free account, then Pro.
Program
Measure where you are and sequence the work into a plan the organisation can fund.
- Assessment·StarterNew
API Security Posture Score
Score your API security 0–100 across 10 areas with evidence-capped maturity and top gaps.
API1–API10 (all)Free · Pro exportFree: the assessment, score, gaps, 30/60/90 plan and share link. Pro: CSV and Markdown export.
- Generator·StarterNew
API Security Roadmap Builder
Answer 10 questions and get a phased 30/60/90-day, 6- and 12-month API security program.
API1–API10 (all)Free · Pro exportFree: the roadmap, Markdown and print/PDF. Pro: the roadmap pack (RACI per phase and a board one-pager).
Coverage matrix: OWASP API Security Top 10 2023 × PlayCISO
A dot means the tool or lab practises, checks or produces controls for that item. The posture score and the roadmap builder span all ten by design, so they are not ticked here. Scroll the table sideways on a small screen.
| Tool or lab | API1BOLA | API2Broken authentication | API3Object property level authZ | API4Resource consumption | API5BFLA | API6Sensitive business flows | API7SSRF | API8Misconfiguration | API9Inventory | API10Unsafe consumption |
|---|---|---|---|---|---|---|---|---|---|---|
| API & Service Auth Lab | · | ● | · | · | · | · | · | ● | · | · |
| OAuth Flow Lab | · | ● | · | · | · | · | · | · | · | · |
| JWT Decoder | · | ● | · | · | · | · | · | · | · | · |
| JWT Attack & Defense Lab | · | ● | · | · | · | · | · | · | · | · |
| Token Lifecycle Lab | · | ● | · | · | · | · | · | · | · | · |
| OAuth Consent Lab | · | ● | · | · | · | · | · | · | · | · |
| mTLS Handshake Lab | · | ● | · | · | · | · | · | ● | · | · |
| API Security Policy Builder | ● | ● | ● | ● | ● | ● | ● | ● | ● | ● |
| OpenAPI Spec Gap Analyser | ● | ● | ● | ● | ● | · | · | ● | ● | · |
| SSRF Defense Checklist | · | · | · | · | · | · | ● | · | · | · |
| API Data Exposure Lab | · | · | ● | · | · | · | · | · | · | · |
| Secret Scanner | · | ● | · | · | · | · | · | · | · | · |
| API Gateway Config Lab | · | ● | · | ● | ● | · | · | ● | · | · |
| Rate-Limit & Abuse Tuner | · | · | · | ● | · | ● | · | · | · | · |
| Shadow API Discovery Lab | · | · | · | · | · | · | · | ● | ● | · |
| Leaked Credential Response | · | ● | · | · | · | · | · | · | · | · |
| Hands-on lab? | Coming | Yes | Yes | Yes | Yes | Yes | Coming | Yes | Yes | Coming |
By OWASP item
API1:2023 Broken Object Level Authorization
API Security Policy Builder, OpenAPI Spec Gap Analyser
No hands-on BOLA lab yet (coming). Today: the policy builder writes the object-level authorisation rules, the OpenAPI analyser flags object-ID parameters on unauthenticated operations, and the data exposure lab shows where a property-level hole becomes an object-level one.
API2:2023 Broken Authentication
API & Service Auth Lab, OAuth Flow Lab, JWT Decoder, JWT Attack & Defense Lab, Token Lifecycle Lab, OAuth Consent Lab, mTLS Handshake Lab, API Security Policy Builder, OpenAPI Spec Gap Analyser, Secret Scanner, API Gateway Config Lab, Leaked Credential Response
API3:2023 Broken Object Property Level Authorization
API Security Policy Builder, OpenAPI Spec Gap Analyser, API Data Exposure Lab
API4:2023 Unrestricted Resource Consumption
API Security Policy Builder, OpenAPI Spec Gap Analyser, API Gateway Config Lab, Rate-Limit & Abuse Tuner
API5:2023 Broken Function Level Authorization
API Security Policy Builder, OpenAPI Spec Gap Analyser, API Gateway Config Lab
API6:2023 Unrestricted Access to Sensitive Business Flows
API Security Policy Builder, Rate-Limit & Abuse Tuner
Business-flow abuse depends on product logic. The rate-limit tuner is the hands-on practice; specs and gateways only cover part of it.
API7:2023 Server Side Request Forgery
API Security Policy Builder, SSRF Defense Checklist
Covered by the SSRF defense checklist and the outbound-calls section of the policy builder. No hands-on lab yet (coming).
API8:2023 Security Misconfiguration
API & Service Auth Lab, mTLS Handshake Lab, API Security Policy Builder, OpenAPI Spec Gap Analyser, API Gateway Config Lab, Shadow API Discovery Lab
API9:2023 Improper Inventory Management
API Security Policy Builder, OpenAPI Spec Gap Analyser, Shadow API Discovery Lab
API10:2023 Unsafe Consumption of APIs
No hands-on lab yet (coming). Today: the third-party consumption section of the policy builder.
Frequently asked questions
Where should I start learning API security?
Start with authentication, because most API attacks begin with a token or key that is accepted when it should not be. Work through the API & Service Auth Lab and the OAuth Flow Lab, then the JWT and token lifecycle labs. Next, write down what good looks like with the API Security Policy Builder and check a real specification with the OpenAPI Gap Analyser. Then practise review and runtime defence: the data exposure lab, the gateway config lab, the rate-limit tuner and the shadow API discovery lab. Finish with the posture score and the roadmap builder to turn it into a program.
What is the OWASP API Security Top 10 2023?
It is the OWASP list of the ten most important API security risks, published in 2023: API1 Broken Object Level Authorization, API2 Broken Authentication, API3 Broken Object Property Level Authorization, API4 Unrestricted Resource Consumption, API5 Broken Function Level Authorization, API6 Unrestricted Access to Sensitive Business Flows, API7 Server Side Request Forgery, API8 Security Misconfiguration, API9 Improper Inventory Management and API10 Unsafe Consumption of APIs.
Which OWASP API Top 10 items have no hands-on lab yet?
API1 Broken Object Level Authorization (BOLA), API7 Server Side Request Forgery and API10 Unsafe Consumption of APIs do not have a dedicated hands-on lab yet; they are coming. For API1 today, use the authorisation section of the API Security Policy Builder, the OpenAPI Gap Analyser (which flags object-ID parameters on unauthenticated operations) and the API Data Exposure Lab, which shows where a property-level hole becomes an object-level one. For API10, use the third-party consumption section of the policy builder. For API7, use the SSRF Defense Checklist and the outbound-calls section of the policy builder.
Which API security tools are free?
The API Data Exposure Lab, API Gateway Config Lab, Rate-Limit & Abuse Tuner and Shadow API Discovery Lab are free, including their exports. The API Security Policy Builder, OpenAPI Gap Analyser, API Security Posture Score and API Security Roadmap Builder are free to use, with a Pro export or pack. The identity labs (API & Service Auth, OAuth Flow, OAuth Consent, JWT, Token Lifecycle, mTLS), the JWT Decoder, the SSRF Defense Checklist, the Secret Scanner and Leaked Credential Response are Pro tools with 3 free runs on a free account. Each card on this page states its access.
Do the labs touch real APIs?
No. Every lab and tool here runs in your browser on synthetic data: invented companies, .example domains and documentation IP ranges. Specifications and answers you paste are not uploaded to PlayCISO.
What do the levels mean?
Starter means no prior API security knowledge is needed. Practitioner assumes you know HTTP, tokens and basic OWASP terms. Advanced assumes hands-on experience operating services. Labs marked with Rookie, Pro and Elite difficulties let you start easy and turn the difficulty up on the same lab.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.