No theme, no story: each of these exists to make one testing technique reachable. Real OAuth tokens that really expire, HMAC-signed webhook deliveries you can replay, a fault injector that fails on request, and a protocol bench covering the parts of HTTP that mock APIs usually skip.
Everything else in the catalog wraps a technique in a theme. These do not: each one exists so that a specific mechanism is reachable in isolation, with nothing else in the way. The auth playground issues real signed JWTs and runs real OAuth flows; the webhook API signs its deliveries with an HMAC you can verify or deliberately fail; the protocol bench covers redirects, content negotiation, JSON Patch, ranges and conditional requests.
If you arrived here from a specific problem — a token that expires mid-suite, a signature that will not verify, a redirect chain your client follows too far — this is the group that has an endpoint for it.