Catch Broken API Auth in CI — Before It Hits Production

CI is good at CVE scans and IaC lint. It is weak at asking whether a new route has the right OAuth scopes or tenant checks.

Security writes a policy. Developers change the OpenAPI file. Operators tweak the IdP proxy. Those three sources drift, and you get broken object-level authorization (BOLA) behind a passing build.

Put the access baseline next to the code. In CI, reject PRs that add an endpoint without an auth scheme, skip step-up on admin paths, or weaken tenant isolation.

Authenticate the pipeline itself with workload identity — OIDC from GitHub Actions or GitLab — instead of a long-lived cloud key in secrets. If the runner cannot prove who it is, it should not talk to prod.

Catching mistakes at merge time is half the job. The other half is making sure runtime matches Git.

AuthOne can take the validated policy from the deploy and apply it at the gateway: token checks, SAML where you still need it, MFA on the sensitive routes. No weekend of clicking through IdP consoles.

Once the API is live, compare requests to the OpenAPI you published. Unknown paths, stale scopes, and junk auth headers are drift — treat them as incidents, not log noise.

Feed that back to the repo and the SIEM. The loop is simple: define in Git, prove in CI, enforce at the edge, alert when reality diverges.