In this paper, we investigate the PHY-layer authentication that exploits radio channel information (such as received signal strength indicators) to detect spoofing attacks in wireless networks. The interactions between a legitimate receiver and spoofers are formulated as a zero-sum authentication game. The receiver chooses the test threshold in the hypothesis test to maximize its utility based on the Bayesian risk in the spoofing detection, whereas the spoofers determine their attack frequencies to minimize the utility of the receiver. The Nash equilibrium of the static authentication game is derived, and its uniqueness is discussed. We also investigate a repeated PHY-layer authentication game for a dynamic radio environment. As it is challenging for the radio nodes to obtain the exact channel parameters in advance, we propose spoofing detection schemes based on Q-learning and Dyna-Q, which achieve the optimal test threshold in the spoofing detection via reinforcement learning. We implement the PHY-layer spoofing detectors over universal software radio peripherals and evaluate their performance via experiments in indoor environments. Both simulation and experimental results have validated the efficiency of the proposed strategies.