Should I use a separate tool for security testing of APIs?

Yes—usually you should use a separate tool for security testing of APIs.

Why:

• Different goals: Functional API testing checks correctness; security testing looks for auth issues, injection, rate limits, exposure of secrets, misconfigurations, and abuse cases.
• Specialized features: Security tools often support fuzzing, attack payloads, session handling, role-based testing, and vulnerability detection.
• Safer workflow: Keeping security tests separate reduces the risk of accidentally running destructive tests in normal test suites.
• Better reporting: Security findings are usually easier to track and triage in a dedicated tool or pipeline stage.

Good practice:

• Use your regular API test tool for functional/regression tests.
• Use a dedicated security tool for:
  • authentication/authorization checks
  • input validation and injection testing
  • schema/parameter fuzzing
  • exposure of sensitive data
  • rate limiting and abuse tests
• Run security tests in a staging or dedicated test environment, not production.

If you want, I can suggest a good setup based on your stack (e.g., Postman, CI/CD, OWASP ZAP, Burp Suite, Insomnia, k6, etc.).