diff --git a/tests/unit.h b/tests/unit.h
index afacf9c38..a104e6490 100644
--- a/tests/unit.h
+++ b/tests/unit.h
@@ -23,6 +23,8 @@
 #ifndef TESTS_UNIT_H
 #define TESTS_UNIT_H
 
+#define WOLFSSL_ALLOW_TEST_APIS
+
 #ifdef HAVE_CONFIG_H
     #include <config.h>
 #endif
diff --git a/wolfssl/internal.h b/wolfssl/internal.h
index 25151ada2..e8af75e86 100644
--- a/wolfssl/internal.h
+++ b/wolfssl/internal.h
@@ -2435,8 +2435,8 @@ typedef struct CipherSuite {
 #endif
 } CipherSuite;
 
-/* use wolfSSL_API visibility to be able to test in tests/api.c */
-WOLFSSL_API void InitSuitesHashSigAlgo(byte* hashSigAlgo, int have,
+/* use wolfSSL_TEST_API visibility to be able to test in tests/api.c */
+WOLFSSL_TEST_API void InitSuitesHashSigAlgo(byte* hashSigAlgo, int have,
                                        int tls1_2, int keySz, word16* len);
 WOLFSSL_LOCAL int AllocateCtxSuites(WOLFSSL_CTX* ctx);
 WOLFSSL_LOCAL int AllocateSuites(WOLFSSL* ssl);
@@ -3396,7 +3396,7 @@ WOLFSSL_LOCAL int   TLSX_CSR2_ForceRequest(WOLFSSL* ssl);
 #if defined(WOLFSSL_PUBLIC_ASN) && defined(HAVE_PK_CALLBACKS)
 /* Internal callback guarded by WOLFSSL_PUBLIC_ASN because of DecodedCert. */
 typedef int (*CallbackProcessPeerCert)(WOLFSSL* ssl, DecodedCert* p_cert);
-WOLFSSL_API void wolfSSL_CTX_SetProcessPeerCertCb(WOLFSSL_CTX* ctx,
+WOLFSSL_TEST_API void wolfSSL_CTX_SetProcessPeerCertCb(WOLFSSL_CTX* ctx,
        CallbackProcessPeerCert cb);
 #endif /* DecodedCert && HAVE_PK_CALLBACKS */
 
@@ -4701,7 +4701,7 @@ WOLFSSL_LOCAL WOLFSSL_SESSION* wolfSSL_GetSession(
 WOLFSSL_LOCAL void SetupSession(WOLFSSL* ssl);
 WOLFSSL_LOCAL void AddSession(WOLFSSL* ssl);
 /* use wolfSSL_API visibility to be able to test in tests/api.c */
-WOLFSSL_API int AddSessionToCache(WOLFSSL_CTX* ctx,
+WOLFSSL_TEST_API int AddSessionToCache(WOLFSSL_CTX* ctx,
     WOLFSSL_SESSION* addSession, const byte* id, byte idSz, int* sessionIndex,
     int side, word16 useTicket, ClientSession** clientCacheEntry);
 #ifndef NO_CLIENT_CACHE
@@ -4717,8 +4717,8 @@ WOLFSSL_LOCAL int TlsSessionCacheGetAndRdLock(const byte *id,
 WOLFSSL_LOCAL int TlsSessionCacheGetAndWrLock(const byte *id,
     WOLFSSL_SESSION **sess, word32 *lockedRow, byte side);
 WOLFSSL_LOCAL void EvictSessionFromCache(WOLFSSL_SESSION* session);
-/* WOLFSSL_API to test it in tests/api.c */
-WOLFSSL_API int wolfSSL_GetSessionFromCache(WOLFSSL* ssl, WOLFSSL_SESSION* output);
+/* WOLFSSL_TEST_API to test it in tests/api.c */
+WOLFSSL_TEST_API int wolfSSL_GetSessionFromCache(WOLFSSL* ssl, WOLFSSL_SESSION* output);
 WOLFSSL_LOCAL int wolfSSL_SetSession(WOLFSSL* ssl, WOLFSSL_SESSION* session);
 WOLFSSL_LOCAL void wolfSSL_FreeSession(WOLFSSL_CTX* ctx,
         WOLFSSL_SESSION* session);
@@ -6382,7 +6382,7 @@ WOLFSSL_LOCAL int  SetSSL_CTX(WOLFSSL* ssl, WOLFSSL_CTX* ctx, int writeDup);
 WOLFSSL_LOCAL int  InitSSL(WOLFSSL* ssl, WOLFSSL_CTX* ctx, int writeDup);
 WOLFSSL_LOCAL int  ReinitSSL(WOLFSSL* ssl, WOLFSSL_CTX* ctx, int writeDup);
 WOLFSSL_LOCAL void FreeSSL(WOLFSSL* ssl, void* heap);
-WOLFSSL_API   void wolfSSL_ResourceFree(WOLFSSL* ssl);   /* Micrium uses */
+WOLFSSL_TEST_API   void wolfSSL_ResourceFree(WOLFSSL* ssl);   /* Micrium uses */
 #ifndef OPENSSL_COEXIST
 #define SSL_ResourceFree wolfSSL_ResourceFree
 #endif
@@ -6748,18 +6748,18 @@ WOLFSSL_LOCAL word32 MacSize(const WOLFSSL* ssl);
 #ifdef WOLFSSL_DTLS
     WOLFSSL_LOCAL DtlsMsg* DtlsMsgNew(word32 sz, byte tx, void* heap);
     WOLFSSL_LOCAL void DtlsMsgDelete(DtlsMsg* item, void* heap);
-    /* Use WOLFSSL_API to enable src/api.c testing */
-    WOLFSSL_API void DtlsMsgListDelete(DtlsMsg* head, void* heap);
+    /* Use WOLFSSL_TEST_API to enable src/api.c testing */
+    WOLFSSL_TEST_API void DtlsMsgListDelete(DtlsMsg* head, void* heap);
     WOLFSSL_LOCAL void DtlsTxMsgListClean(WOLFSSL* ssl);
     WOLFSSL_LOCAL int  DtlsMsgSet(DtlsMsg* msg, word32 seq, word16 epoch,
                                   const byte* data, byte type,
                                   word32 fragOffset, word32 fragSz, void* heap,
                                   word32 totalLen, byte encrypted);
-    /* Use WOLFSSL_API to enable src/api.c testing */
-    WOLFSSL_API DtlsMsg* DtlsMsgFind(DtlsMsg* head, word16 epoch, word32 seq);
+    /* Use WOLFSSL_TEST_API to enable src/api.c testing */
+    WOLFSSL_TEST_API DtlsMsg* DtlsMsgFind(DtlsMsg* head, word16 epoch, word32 seq);
 
-    /* Use WOLFSSL_API to enable src/api.c testing */
-    WOLFSSL_API void DtlsMsgStore(WOLFSSL* ssl, word16 epoch, word32 seq,
+    /* Use WOLFSSL_TEST_API to enable src/api.c testing */
+    WOLFSSL_TEST_API void DtlsMsgStore(WOLFSSL* ssl, word16 epoch, word32 seq,
                                     const byte* data, word32 dataSz, byte type,
                                     word32 fragOffset, word32 fragSz,
                                     void* heap);
@@ -6949,8 +6949,8 @@ WOLFSSL_LOCAL int BuildMessage(WOLFSSL* ssl, byte* output, int outSz,
                         int sizeOnly, int asyncOkay, int epochOrder);
 
 #ifdef WOLFSSL_TLS13
-/* Use WOLFSSL_API to use this function in tests/api.c */
-WOLFSSL_API int BuildTls13Message(WOLFSSL* ssl, byte* output, int outSz, const byte* input,
+/* Use WOLFSSL_TEST_API to use this function in tests/api.c */
+WOLFSSL_TEST_API int BuildTls13Message(WOLFSSL* ssl, byte* output, int outSz, const byte* input,
                int inSz, int type, int hashOutput, int sizeOnly, int asyncOkay);
 WOLFSSL_LOCAL int Tls13UpdateKeys(WOLFSSL* ssl);
 #endif
@@ -7007,7 +7007,7 @@ WOLFSSL_LOCAL word32 nid2oid(int nid, int grp);
 #endif
 
 #ifdef WOLFSSL_DTLS
-WOLFSSL_API int wolfSSL_DtlsUpdateWindow(word16 cur_hi, word32 cur_lo,
+WOLFSSL_TEST_API int wolfSSL_DtlsUpdateWindow(word16 cur_hi, word32 cur_lo,
         word16* next_hi, word32* next_lo, word32 *window);
 WOLFSSL_LOCAL int DtlsUpdateWindow(WOLFSSL* ssl);
 WOLFSSL_LOCAL void DtlsResetState(WOLFSSL *ssl);
@@ -7017,8 +7017,8 @@ WOLFSSL_LOCAL void DtlsSetSeqNumForReply(WOLFSSL* ssl);
 
 #ifdef WOLFSSL_DTLS13
 
-/* Use WOLFSSL_API to use this function in tests/api.c */
-WOLFSSL_API struct Dtls13Epoch* Dtls13GetEpoch(WOLFSSL* ssl,
+/* Use WOLFSSL_TEST_API to use this function in tests/api.c */
+WOLFSSL_TEST_API struct Dtls13Epoch* Dtls13GetEpoch(WOLFSSL* ssl,
     w64wrapper epochNumber);
 WOLFSSL_LOCAL void Dtls13SetOlderEpochSide(WOLFSSL* ssl, w64wrapper epochNumber,
     int side);
@@ -7109,8 +7109,8 @@ typedef struct CRYPTO_EX_cb_ctx {
 } CRYPTO_EX_cb_ctx;
 
 /* use wolfSSL_API visibility to be able to clear in tests/api.c */
-WOLFSSL_API extern CRYPTO_EX_cb_ctx* crypto_ex_cb_ctx_session;
-WOLFSSL_API void crypto_ex_cb_free(CRYPTO_EX_cb_ctx* cb_ctx);
+WOLFSSL_TEST_API extern CRYPTO_EX_cb_ctx* crypto_ex_cb_ctx_session;
+WOLFSSL_TEST_API void crypto_ex_cb_free(CRYPTO_EX_cb_ctx* cb_ctx);
 WOLFSSL_LOCAL void crypto_ex_cb_setup_new_data(void *new_obj,
         CRYPTO_EX_cb_ctx* cb_ctx, WOLFSSL_CRYPTO_EX_DATA* ex_data);
 WOLFSSL_LOCAL void crypto_ex_cb_free_data(void *obj, CRYPTO_EX_cb_ctx* cb_ctx,
diff --git a/wolfssl/wolfcrypt/visibility.h b/wolfssl/wolfcrypt/visibility.h
index aa506ba21..ca78ecc31 100644
--- a/wolfssl/wolfcrypt/visibility.h
+++ b/wolfssl/wolfcrypt/visibility.h
@@ -50,7 +50,13 @@
         #define WOLFSSL_API
         #define WOLFSSL_LOCAL
     #endif /* HAVE_VISIBILITY */
-#else /* BUILDING_WOLFSSL */
+
+    #ifdef WOLFSSL_LOCALIZE_TEST_APIS
+        #define WOLFSSL_TEST_API WOLFSSL_LOCAL
+    #else
+        #define WOLFSSL_TEST_API WOLFSSL_API
+    #endif
+#else /* !BUILDING_WOLFSSL */
     #if defined(__WATCOMC__)
         #if defined(WOLFSSL_DLL) && defined(__NT__)
             #define WOLFSSL_API __declspec(dllimport)
@@ -70,7 +76,16 @@
         #define WOLFSSL_API
         #define WOLFSSL_LOCAL
     #endif
-#endif /* BUILDING_WOLFSSL */
+
+    #ifdef WOLFSSL_LOCALIZE_TEST_APIS
+        #define WOLFSSL_TEST_API WOLFSSL_LOCAL WC_DEPRECATED
+    #elif defined(WOLFSSL_ALLOW_TEST_APIS)
+        #define WOLFSSL_TEST_API WOLFSSL_API
+    #else
+        #define WOLFSSL_TEST_API WOLFSSL_API WC_DEPRECATED
+    #endif
+
+#endif /* !BUILDING_WOLFSSL */
 
 /* WOLFSSL_ABI is used for public API symbols that must not change
  * their signature. This tag is used for all APIs that are a
diff --git a/wolfssl/wolfcrypt/wc_port.h b/wolfssl/wolfcrypt/wc_port.h
index b0778dfb9..343770e8c 100644
--- a/wolfssl/wolfcrypt/wc_port.h
+++ b/wolfssl/wolfcrypt/wc_port.h
@@ -82,6 +82,15 @@
     #endif
 #endif /* !WC_MAYBE_UNUSED */
 
+#ifndef WC_DEPRECATED
+    #if (defined(__GNUC__) && (__GNUC__ >= 4)) || defined(__clang__) || \
+            defined(__IAR_SYSTEMS_ICC__)
+        #define WC_DEPRECATED __attribute__((deprecated))
+    #else
+        #define WC_DEPRECATED
+    #endif
+#endif /* !WC_MAYBE_UNUSED */
+
 /* use inlining if compiler allows */
 #ifndef WC_INLINE
 #ifndef NO_INLINE