Test your security integrations before your customers do.
Helena is a hosted test harness for identity, authentication and security integrations. Point it at your system and Helena plays the other side — an identity provider, an OAuth client, a SIEM, a webhook receiver — then checks your system behaves exactly the way the specifications say it must.
Run manually · on a schedule · from any CI/CD pipeline
What you can test
Helena plays the other side of the integration
A security integration that accepts everything is the most dangerous kind of broken. Every Helena test can expect your system to succeed or to refuse — so negative cases are first-class, not an afterthought.
OIDC Workload Identity Federation
Helena acts as a workload and its OIDC identity provider. Check that Google Cloud STS, Entra, AWS STS or Keycloak accept a valid federated token — and refuse expired, mis-addressed or forged ones.
OAuth 2.0 Client Credentials
Helena acts as an OAuth client. Verify your authorization server issues tokens through the client credentials grant exactly as RFC 6749 requires, and refuses revoked clients.
SCIM 2.0 Provisioning
Helena acts as an identity provider like Okta or Entra ID. Confirm your SCIM endpoints implement user and group provisioning the way real IdPs will call them.
SIEM REST API Poll
Helena acts as a SIEM or log collector. Make sure your audit log API serves events with working time windows, pagination and authentication before a customer's SOC wires it up.
Webhook Request Catcher
Your application calls Helena. Get a permanent endpoint, return the response you configure, and assert that the right webhooks and callbacks arrive — or that they don't.
More test types coming
- SAML 2.0 & OAuth / OIDC flows
- X.509 ACME clients & servers
- Stub API responses
- Short-lived mTLS & SSH certificates
How it works
Configure once. Run it everywhere.
-
1
Create a test
Choose a test type, point it at your endpoint and say what you expect. Sensible defaults mean most tests take a minute to set up. Keep separate environments for development and production.
-
2
Run it your way
Select Run now, put it on a schedule, or trigger it from your pipeline through the REST API. Service accounts can authenticate with GitHub Actions or GitLab OIDC — no secret to store.
-
3
Read the evidence
Every run lands in the Test Log as passed, failed or error, with each request, response and assertion. Every action is recorded in an audit log.
# Fail the build unless the Helena test passes
- name: Run Helena test
run: |
curl -sf -X POST \
-H "Authorization: Bearer $HELENA_TOKEN" \
-H 'Content-Type: application/json' \
-d '{"wait": true}' \
"https://app.helena.dev/api/v1/environments/\
$ENV_UUID/tests/$TEST_UUID/runs" \
| jq -e '.data.status == "passed"'Pricing
Simple pricing, based on tests per month
Every plan includes every test type and every feature. You only choose how many tests you run each month.
For teams testing on every merge.
For scheduled monitoring across environments.
- All test types
- Manual, scheduled and API-triggered runs
- REST API & service accounts with OIDC
- Multiple environments
- Full Test Logs with every request & assertion
- Audit log, RBAC & two-factor authentication
Need more than 600 tests a month? Talk to us. Prices in USD. Payments are processed securely by Stripe.
FAQ
Common questions
What counts as a test?
Each time a test runs, it counts as one test against your monthly allowance — whether you start it with Run now, from a schedule, or through the API. Creating and editing tests, reading Test Logs and calling read-only API endpoints are free.
Does my system need to be reachable from the internet?
Yes. Helena runs every check from its own infrastructure against your public HTTPS endpoints — the same way your real customers' identity providers, SIEMs and clients will reach you.
How do you handle the secrets I give Helena?
Client secrets, bearer tokens and API keys are encrypted at rest and never displayed again after you save them. In Test Logs they appear only as fingerprints, such as [redacted 40 chars sha256:3f9a…].
Can I run Helena from my CI/CD pipeline?
Yes. Create a service account, then call the REST API to trigger a run and wait for the result. GitHub Actions and GitLab CI can authenticate with OIDC workload identity, so there's no Helena secret to store or rotate. Any other CI can use a client ID and secret.
Can I change plans later?
Any time, from Configuration → Billing. Plan changes take effect immediately and are prorated. If you cancel, you keep access until the end of the billing period.
Find out what your integration really accepts.
Start on the free plan and run your first test in minutes.