OpenAPI authentication check — check your api specification free

Finds the lines in an OpenAPI file that publish an endpoint with no authentication, an API key in the query string, or an OAuth grant that RFC 9700 forbids. Runs entirely in your browser — nothing is uploaded.

openapi: 3.0.3
info:
  title: Billing API
  version: 2026.09.1
servers:
  - url: http://api.example.com/v2
paths:
  /invoices:
    get:
      summary: List invoices
      security: []
      responses:
        '200':
          description: A page of invoices
    post:
      summary: Create an invoice
      deprecated: true
      security:
        - apiKeyAuth: []
      requestBody:
        content:
          application/json:
            schema:
              type: object
              additionalProperties: true
              properties:
                amountMinor:
                  type: integer
                callbackToken:
                  type: string
                  example: sk_live_4eC39HqLyjWDarjtT1zdp7dc
      responses:
        '201':
          description: Invoice created
  /debug/vars:
    get:
      summary: Runtime counters
      responses:
        '200':
          description: Counters
components:
  securitySchemes:
    apiKeyAuth:
      type: apiKey
      in: query
      name: api_key
    basicAuth:
      type: http
      scheme: basic
    oauth2Auth:
      type: oauth2
      flows:
        implicit:
          authorizationUrl: http://auth.example.net/authorize
          scopes: {}
        password:
          tokenUrl: http://auth.example.net/token
          scopes:
            '*': Everything this API can do

as of

Free here: Audit the OpenAPI file open in the editor, line by line. In the editor: Sweep every OpenAPI file in the workspace and keep a dated report (CSV/JSON/HTML) as release evidence — that part asks for a licence key.

$29 once · one licence key per person or CI seat · An application-security consultant reading the same contract by hand bills $150-$250 an hour.

Same engine as the VS Code extension, byte for byte.