Use Hoppscotch with a small API collection that covers authentication, an expected success, and an expected failure. Configure separate development and staging environments, then ask another developer to reproduce the requests without sharing your credentials.
Check how collections, variables, and secrets are stored in the deployment mode you choose. Export the work and verify it can be restored. An API client is valuable when it captures enough context to repeat an investigation while keeping tokens out of shared artifacts.
Akousa