API Testing Platform Security Testing

Hoppscotch Security Testing: Default Credentials, API Key, Database, and JWT Secret

📅 July 3, 2026 ⏱ 11 min read 🏷 Hoppscotch, API Testing Platform Security, JWT Secret, Workspace Environment Variables, Team API Credentials, PostgreSQL

Hoppscotch is a widely deployed self-hosted open-source API testing platform used as a team alternative to Postman — it stores all API collections, request configurations, and critically, workspace environment variables that contain the API keys and secrets teams use for testing their own services. Key assessment areas: JWT_SECRET signs all authentication tokens enabling session forgery; workspace environments accumulate API keys, database connection strings, OAuth client secrets, and bearer tokens; the PostgreSQL database stores all team-shared environment variable values; and the admin API enables full user and workspace enumeration. This guide covers systematic Hoppscotch security assessment.

Authentication and Admin API Testing
Workspace Environment Variable API Key Extraction
JWT Secret and Database Credential Extraction
Hoppscotch Security Hardening

Authentication and Admin API Testing

# Hoppscotch — authentication and admin API testing
HOPPSCOTCH_URL="https://hoppscotch.example.com"

# Hoppscotch uses OAuth2/magic link authentication + JWT tokens
# Admin API is available at /v1/admin/*

# Test admin API access (requires admin user JWT)
ADMIN_JWT="your-admin-jwt-token"
curl -s "${HOPPSCOTCH_URL}/v1/admin/users?take=100&skip=0" \
  -H "Authorization: Bearer ${ADMIN_JWT}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
users = d.get('users',[])
total = d.get('totalUserCount',len(users))
print(f'Users: {total} total')
for u in users[:10]:
    print(f'  [{u.get(\"uid\",\"\")[:8]}] {u.get(\"email\")} admin={u.get(\"isAdmin\")} created={str(u.get(\"createdOn\",\"\"))[:10]}')
" 2>/dev/null

# List all teams/workspaces
curl -s "${HOPPSCOTCH_URL}/v1/admin/teams?take=50&skip=0" \
  -H "Authorization: Bearer ${ADMIN_JWT}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
teams = d.get('teams',[])
print(f'Teams: {len(teams)}')
for t in teams[:10]:
    print(f'  [{t.get(\"id\",\"\")[:8]}] {t.get(\"name\")} members={t.get(\"membersCount\")}')
" 2>/dev/null

# Get personal access tokens for all users
curl -s "${HOPPSCOTCH_URL}/v1/admin/users/{user-id}" \
  -H "Authorization: Bearer ${ADMIN_JWT}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
print(f'User: {d.get(\"email\")} admin={d.get(\"isAdmin\")}')
# Personal access tokens allow API access
" 2>/dev/null

Workspace Environment Variable API Key Extraction

# Hoppscotch — workspace environment variable API key extraction
# This is the CRITICAL risk: team environments store API keys for all tested services

HOPPSCOTCH_URL="https://hoppscotch.example.com"
USER_JWT="your-user-jwt-token"

# Get all personal environments (user's own env variables)
curl -s "${HOPPSCOTCH_URL}/v1/user/environments" \
  -H "Authorization: Bearer ${USER_JWT}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
envs = d if isinstance(d,list) else d.get('environments',[])
print(f'Personal environments: {len(envs)}')
for env in envs:
    print(f'  Env: {env.get(\"name\")}')
    variables = env.get('variables',[])
    for v in variables:
        key = v.get('key','')
        val = v.get('value','')
        # Secret values often hidden by default but visible to owner
        if any(s in key.upper() for s in ['KEY','SECRET','TOKEN','PASS','AUTH','BEARER','CRED']):
            print(f'    SECRET: {key}={str(val)[:60]}')
        else:
            print(f'    {key}={str(val)[:40]}')
" 2>/dev/null

# Get team environments (shared across team members)
TEAM_ID="your-team-id"
curl -s "${HOPPSCOTCH_URL}/v1/teams/${TEAM_ID}/environments" \
  -H "Authorization: Bearer ${USER_JWT}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
envs = d if isinstance(d,list) else d.get('environments',[])
print(f'Team environments: {len(envs)}')
for env in envs:
    print(f'  Team Env: {env.get(\"name\")}')
    variables = env.get('variables',[])
    for v in variables:
        key = v.get('key','')
        val = v.get('value','')
        print(f'    {key}={str(val)[:60]}')
" 2>/dev/null
# Team environments are shared — any team member can see all values
# Common stored secrets: API keys, database URLs, JWT secrets, OAuth credentials

# List team collections (API request library)
curl -s "${HOPPSCOTCH_URL}/v1/teams/${TEAM_ID}/collections" \
  -H "Authorization: Bearer ${USER_JWT}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
colls = d if isinstance(d,list) else d.get('collections',[])
print(f'Team collections: {len(colls)}')
for c in colls[:10]:
    print(f'  {c.get(\"title\")} requests={c.get(\"requestCount\",0)}')
" 2>/dev/null

JWT Secret and Database Credential Extraction

# Hoppscotch JWT secret and database credential extraction

# Docker Compose / environment variables
docker inspect hoppscotch-backend 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
for c in d:
    for e in c.get('Config',{}).get('Env',[]):
        if any(k in e for k in ['JWT','SECRET','DATABASE','SMTP','GOOGLE','GITHUB','MICROSOFT','OAUTH']):
            print(e)
" 2>/dev/null
# JWT_SECRET — signs all authentication tokens
# DATABASE_URL — PostgreSQL connection string with credentials
# GOOGLE_CLIENT_ID/SECRET, GITHUB_CLIENT_ID/SECRET — OAuth2 provider secrets
# SMTP_PASSWORD — email relay credentials
# VITE_BACKEND_GQL_URL — GraphQL API endpoint

# PostgreSQL — all Hoppscotch data
DB_URL="postgresql://hoppscotch:PASSWORD@localhost/hoppscotch"

# Personal access tokens (API keys for programmatic access)
psql "$DB_URL" 2>/dev/null << 'EOF'
SELECT pat.id, pat.label,
       pat.token,
       pat.created_on, pat.updated_on,
       u.email as user_email
FROM "PersonalAccessToken" pat
JOIN "User" u ON pat."userUid" = u.uid
ORDER BY pat.created_on DESC
LIMIT 10;
EOF
-- token: plaintext personal access token — full API access for the user

-- All environment variables (THE KEY PRIZE)
psql "$DB_URL" 2>/dev/null << 'EOF'
SELECT e.id, e.name,
       e.variables::text as variables_json,
       u.email as owner
FROM "UserEnvironment" e
JOIN "User" u ON e."userUid" = u.uid
ORDER BY e.id DESC
LIMIT 20;
EOF
-- variables: JSONB array of {key, value} pairs — all API keys and secrets

-- Team environments (shared secrets)
psql "$DB_URL" 2>/dev/null << 'EOF'
SELECT te.id, te.name,
       te.variables::text as variables_json,
       t.name as team_name
FROM "TeamEnvironment" te
JOIN "Team" t ON te."teamID" = t.id
ORDER BY te.id DESC
LIMIT 20;
EOF
-- Team environments expose API secrets to ALL team members

Hoppscotch Security Hardening

Hoppscotch Security Hardening Checklist:

Protect JWT_SECRET as the authentication root of trust — Hoppscotch uses JWT tokens for all user authentication; the JWT_SECRET is the signing key for all access tokens; if compromised, an attacker can forge valid JWT tokens for any user account including admin; generate with `openssl rand -hex 64`; store in environment variables; rotate immediately if compromised (this invalidates all existing sessions); never commit JWT_SECRET to version control; review your .env file in Docker Compose setups to ensure it is excluded from git with .gitignore
Understand the unique risk of API testing platforms — Hoppscotch's core function is storing API request configurations with authentication credentials; teams routinely add API keys, OAuth tokens, database URLs, and service secrets as environment variables for use in API testing; these become a centralized credential store that is often less carefully secured than a dedicated secrets manager; a breach of the Hoppscotch database provides access to credentials for every external service the team has tested against; conduct a quarterly audit of all environment variable values and remove credentials that are no longer needed or have been rotated
Treat team environment variables as shared secrets with broad access — team environments in Hoppscotch are accessible to all team members; a secret added to a team environment by one member (e.g., a production API key for testing) is immediately visible to all other members; implement separate Hoppscotch teams for production vs. staging credentials; train users to use staging/test API keys in shared environments rather than production credentials; personal environments (visible only to the owner) are preferable for sensitive credentials, though they still exist in the database
Restrict admin API access and monitor for enumeration — the Hoppscotch admin API (/v1/admin/*) allows enumeration of all users, teams, and environments; restrict access to this API to authorized administrators; implement network-level controls on the Hoppscotch backend API; monitor admin API access logs for bulk enumeration patterns; the admin API requires an admin user's JWT but does not have additional MFA protection — if an admin account is compromised, the entire platform's credential store is exposed
Protect OAuth2 provider client secrets — Hoppscotch uses OAuth2 for authentication (Google, GitHub, Microsoft); the client secrets for these OAuth2 applications are stored in environment variables; these secrets allow impersonating the Hoppscotch application to OAuth2 providers; if leaked, an attacker could intercept OAuth2 authorization codes; store OAuth2 client secrets in a secrets manager and inject at runtime; rotate client secrets if the environment is compromised; review OAuth2 application permissions to ensure they are minimal (email, profile only — not write access)

Security Test	Method	Risk
JWT_SECRET extraction and session token forgery	Read .env JWT_SECRET — forge valid JWT tokens for any user including admin; bypasses OAuth2 authentication; full access to all workspaces, collections, and environment variables	Critical
PostgreSQL TeamEnvironment API credential extraction	SELECT variables FROM "TeamEnvironment" — JSONB environment variable values including API keys, database URLs, OAuth tokens for all services tested by the team; concentrated credential exfiltration	Critical
PostgreSQL PersonalAccessToken plaintext extraction	SELECT token FROM "PersonalAccessToken" — plaintext API tokens for programmatic Hoppscotch access; full access to the user's collections, environments, and requests	High
Admin API user and team workspace enumeration	GET /v1/admin/users and /v1/admin/teams — full inventory of all users and teams; enables targeted credential extraction for high-value users	High
OAuth2 client secret extraction for provider impersonation	Read Docker env GOOGLE_CLIENT_SECRET / GITHUB_CLIENT_SECRET — OAuth2 client secrets; enables impersonating the Hoppscotch application to OAuth2 providers; intercept authorization flows	High

Automate Hoppscotch Security Testing

Ironimo tests Hoppscotch deployments for JWT_SECRET session token forgery, PostgreSQL TeamEnvironment API credential bulk extraction, PersonalAccessToken plaintext enumeration, admin API user and workspace enumeration, OAuth2 client secret extraction for provider impersonation, team environment variable API key inventory, Docker JWT_SECRET/DATABASE_URL exposure, SMTP_PASSWORD mailer credential extraction, collection request header authorization token scanning, and admin panel unauthorized access testing.

Start free scan

Table of Contents

Authentication and Admin API Testing

Workspace Environment Variable API Key Extraction

JWT Secret and Database Credential Extraction

Hoppscotch Security Hardening

Automate Hoppscotch Security Testing