Authentication schemes
Auth schemes: one endpoint per common scheme (Basic, Bearer, API key in header/query/cookie, Digest, HMAC request signing, role and scope checks, double-submit CSRF) for testing how a client sends credentials. All credentials are hardcoded and listed by GET /api/auth.Auth schemes: one endpoint per common scheme (Basic, Bearer, API key in header/query/cookie, Digest, HMAC request signing, role and scope checks, double-submit CSRF) for testing how a client sends credentials. All credentials are hardcoded and listed by GET ….
Your account unlocks these endpoints. Try it on each endpoint's page sends your key for you; from your own code, send a key from your API keys page in the X-TestingApis-Key header.
These endpoints need a free account. Create one or sign in to see their details and try them here.
- GET
https://api.testingapis.com/api/authList every auth scheme with its test credentialsList every auth scheme with its test credentials. - GET
https://api.testingapis.com/api/auth/api-key/cookieAuthenticate with an API key in the api_key cookieAuthenticate with an API key in the api_key cookie. - GET
https://api.testingapis.com/api/auth/api-key/headerAuthenticate with an API key in the X-API-Key headerAuthenticate with an API key in the X-API-Key header. - GET
https://api.testingapis.com/api/auth/api-key/queryAuthenticate with an API key in the api_key query parameterAuthenticate with an API key in the api_key query parameter. - GET
https://api.testingapis.com/api/auth/basicAuthenticate with HTTP Basic authAuthenticate with HTTP Basic auth. - GET
https://api.testingapis.com/api/auth/basic-hidden/{user}/{pass}Authenticate with Basic auth, returning 404 instead of 401 on failureAuthenticate with Basic auth, returning 404 instead of 401 on failure. - GET
https://api.testingapis.com/api/auth/basic/{user}/{pass}Authenticate with Basic auth against credentials taken from the URLAuthenticate with Basic auth against credentials taken from the URL. - GET
https://api.testingapis.com/api/auth/bearerAuthenticate with a static bearer tokenAuthenticate with a static bearer token. - POST
https://api.testingapis.com/api/auth/csrf/submitSubmit a CSRF-protected formSubmit a CSRF-protected form (double-submit cookie check). - GET
https://api.testingapis.com/api/auth/csrf/tokenIssue a CSRF token and set it as the XSRF-TOKEN cookieIssue a CSRF token and set it as the XSRF-TOKEN cookie. - GET
https://api.testingapis.com/api/auth/digestAuthenticate with HTTP Digest authAuthenticate with HTTP Digest auth (MD5, qop=auth). - POST
https://api.testingapis.com/api/auth/hmacVerify an HMAC-SHA256 request signatureVerify an HMAC-SHA256 request signature. - GET
https://api.testingapis.com/api/auth/roles/adminAllow only tokens with the admin roleAllow only tokens with the admin role (401 vs 403 demo). - DELETE
https://api.testingapis.com/api/auth/roles/resourceAllow only tokens with the delete scopeAllow only tokens with the delete scope. - GET
https://api.testingapis.com/api/auth/roles/userAllow only tokens with the user roleAllow only tokens with the user role.
Example request
List every auth scheme with its test credentials. Full reference and a Send button.
curl -X GET "https://api.testingapis.com/api/auth" \
-H "X-TestingApis-Key: YOUR_API_KEY"{
"message": "Hardcoded credentials for every auth scheme. Send them wrong to test your 401 handling; the role endpoints also return 403.",
"schemes": [
{
"scheme": "basic",
"endpoint": "GET /api/auth/basic",
"credentials": {"username": "apibee", "password": "password123"}
},
{
"scheme": "basic (path creds)",
"endpoint": "GET /api/auth/basic/{user}/{pass}",
"credentials": "Any user/pass — must match the path"
},
"… 12 more items"
… (2 more lines)Sign in to see the details
The parameters, request and response examples and the live Try it panel for these endpoints are for signed-in members. Accounts are free and take a few seconds to create.