Authentifizierungsverfahren

Auth-Verfahren: ein Endpunkt pro gängigem Verfahren (Basic, Bearer, API-Schlüssel in Header/Query/Cookie, Digest, HMAC-Signatur von Requests, Prüfung von Rollen und Scopes, Double-Submit-CSRF), um zu testen, wie ein Client Zugangsdaten sendet. Alle Zugangsdaten sind fest und werden von GET /api/auth aufgelistet.Auth-Verfahren: ein Endpunkt pro gängigem Verfahren (Basic, Bearer, API-Schlüssel in Header/Query/Cookie, Digest, HMAC-Signatur von Requests, Prüfung von Rollen und Scopes, Double-Submit-CSRF), um zu testen, wie ein Client Zugangsdaten sendet. Alle Zugangsdaten sind fest und werden von GET … aufgelistet.

• GEThttps://api.testingapis.com/api/authList every auth scheme with its test credentialsList every auth scheme with its test credentials.
• GEThttps://api.testingapis.com/api/auth/api-key/cookieAuthenticate with an API key in the api_key cookieAuthenticate with an API key in the api_key cookie.
• GEThttps://api.testingapis.com/api/auth/api-key/headerAuthenticate with an API key in the X-API-Key headerAuthenticate with an API key in the X-API-Key header.
• GEThttps://api.testingapis.com/api/auth/api-key/queryAuthenticate with an API key in the api_key query parameterAuthenticate with an API key in the api_key query parameter.
• GEThttps://api.testingapis.com/api/auth/basicAuthenticate with HTTP Basic authAuthenticate with HTTP Basic auth.
• GEThttps://api.testingapis.com/api/auth/basic-hidden/{user}/{pass}Authenticate with Basic auth, returning 404 instead of 401 on failureAuthenticate with Basic auth, returning 404 instead of 401 on failure.
• GEThttps://api.testingapis.com/api/auth/basic/{user}/{pass}Authenticate with Basic auth against credentials taken from the URLAuthenticate with Basic auth against credentials taken from the URL.
• GEThttps://api.testingapis.com/api/auth/bearerAuthenticate with a static bearer tokenAuthenticate with a static bearer token.
• POSThttps://api.testingapis.com/api/auth/csrf/submitSubmit a CSRF-protected formSubmit a CSRF-protected form (double-submit cookie check).
• GEThttps://api.testingapis.com/api/auth/csrf/tokenIssue a CSRF token and set it as the XSRF-TOKEN cookieIssue a CSRF token and set it as the XSRF-TOKEN cookie.
• GEThttps://api.testingapis.com/api/auth/digestAuthenticate with HTTP Digest authAuthenticate with HTTP Digest auth (MD5, qop=auth).
• POSThttps://api.testingapis.com/api/auth/hmacVerify an HMAC-SHA256 request signatureVerify an HMAC-SHA256 request signature.
• GEThttps://api.testingapis.com/api/auth/roles/adminAllow only tokens with the admin roleAllow only tokens with the admin role (401 vs 403 demo).
• DELETEhttps://api.testingapis.com/api/auth/roles/resourceAllow only tokens with the delete scopeAllow only tokens with the delete scope.
• GEThttps://api.testingapis.com/api/auth/roles/userAllow only tokens with the user roleAllow only tokens with the user role.

curl -X GET "https://api.testingapis.com/api/auth"

{
  "message": "Hardcoded credentials for every auth scheme. Send them wrong to test your 401 handling; the role endpoints also return 403.",
  "schemes": [
    {
      "scheme": "basic",
      "endpoint": "GET /api/auth/basic",
      "credentials": {"username": "apibee", "password": "password123"}
    },
    {
      "scheme": "basic (path creds)",
      "endpoint": "GET /api/auth/basic/{user}/{pass}",
      "credentials": "Any user/pass — must match the path"
    },
    "… 12 more items"
… (2 more lines)