Schémas d’authentification

Schémas d’authentification : un point d’accès par schéma courant (Basic, Bearer, clé d’API en en-tête/query/cookie, Digest, signature HMAC des requêtes, contrôle des rôles et des scopes, CSRF à double soumission) pour tester comment un client envoie ses identifiants. Tous les identifiants sont fixes et listés par GET /api/auth.Schémas d’authentification : un point d’accès par schéma courant (Basic, Bearer, clé d’API en en-tête/query/cookie, Digest, signature HMAC des requêtes, contrôle des rôles et des scopes, CSRF à double soumission) pour tester comment un client envoie ses identifiants. Tous les identifiants sont fixes et listés par GET ….

• GEThttps://api.testingapis.com/api/authList every auth scheme with its test credentialsList every auth scheme with its test credentials.
• GEThttps://api.testingapis.com/api/auth/api-key/cookieAuthenticate with an API key in the api_key cookieAuthenticate with an API key in the api_key cookie.
• GEThttps://api.testingapis.com/api/auth/api-key/headerAuthenticate with an API key in the X-API-Key headerAuthenticate with an API key in the X-API-Key header.
• GEThttps://api.testingapis.com/api/auth/api-key/queryAuthenticate with an API key in the api_key query parameterAuthenticate with an API key in the api_key query parameter.
• GEThttps://api.testingapis.com/api/auth/basicAuthenticate with HTTP Basic authAuthenticate with HTTP Basic auth.
• GEThttps://api.testingapis.com/api/auth/basic-hidden/{user}/{pass}Authenticate with Basic auth, returning 404 instead of 401 on failureAuthenticate with Basic auth, returning 404 instead of 401 on failure.
• GEThttps://api.testingapis.com/api/auth/basic/{user}/{pass}Authenticate with Basic auth against credentials taken from the URLAuthenticate with Basic auth against credentials taken from the URL.
• GEThttps://api.testingapis.com/api/auth/bearerAuthenticate with a static bearer tokenAuthenticate with a static bearer token.
• POSThttps://api.testingapis.com/api/auth/csrf/submitSubmit a CSRF-protected formSubmit a CSRF-protected form (double-submit cookie check).
• GEThttps://api.testingapis.com/api/auth/csrf/tokenIssue a CSRF token and set it as the XSRF-TOKEN cookieIssue a CSRF token and set it as the XSRF-TOKEN cookie.
• GEThttps://api.testingapis.com/api/auth/digestAuthenticate with HTTP Digest authAuthenticate with HTTP Digest auth (MD5, qop=auth).
• POSThttps://api.testingapis.com/api/auth/hmacVerify an HMAC-SHA256 request signatureVerify an HMAC-SHA256 request signature.
• GEThttps://api.testingapis.com/api/auth/roles/adminAllow only tokens with the admin roleAllow only tokens with the admin role (401 vs 403 demo).
• DELETEhttps://api.testingapis.com/api/auth/roles/resourceAllow only tokens with the delete scopeAllow only tokens with the delete scope.
• GEThttps://api.testingapis.com/api/auth/roles/userAllow only tokens with the user roleAllow only tokens with the user role.

curl -X GET "https://api.testingapis.com/api/auth"

{
  "message": "Hardcoded credentials for every auth scheme. Send them wrong to test your 401 handling; the role endpoints also return 403.",
  "schemes": [
    {
      "scheme": "basic",
      "endpoint": "GET /api/auth/basic",
      "credentials": {"username": "apibee", "password": "password123"}
    },
    {
      "scheme": "basic (path creds)",
      "endpoint": "GET /api/auth/basic/{user}/{pass}",
      "credentials": "Any user/pass — must match the path"
    },
    "… 12 more items"
… (2 more lines)