Tutorial
Learn API authentication
Most API bugs that make the news are authentication bugs: a token that never expired, a check that ran on one endpoint and not the next, a signature nobody verified. This tutorial goes through the ways APIs identify their callers, from a session cookie to OAuth 2.0, and shows how to test each one from the outside.
The authentication lesson in the API testing tutorial gives the overview in one page. These lessons go deeper, one scheme at a time. Every request was sent to the test endpoints at https://api.testingapis.com, which use published demo credentials, and the responses shown are the ones that came back. The endpoints need a free account; the examples and Send buttons work once you're signed in.
8 lessons3 levelsFree
Beginner
3 lessonsHow a server knows who is calling: sessions, keys, passwords and the tokens that replace them.
- 01Sessions, API keys and tokensThe three ways an API remembers who you are, and what each one costs when it leaks.
- 02Basic and Digest authenticationThe Authorization header, the 401 challenge, and a Digest response worked out by hand.
- 03Inside a JWTHeader, claims and signature, and the changes a server must refuse.
Intermediate
3 lessonsTokens that expire and renew, and OAuth 2.0 from the client's side, one request at a time.
- 04Access and refresh tokensShort-lived tokens, rotation, reuse, and two browser tabs refreshing at once.
- 05OAuth 2.0: grants, scopes and tokensWho's who in OAuth, the grants that matter, and the errors a client should expect.
- 06Authorization code flow with PKCEEvery request in the flow, with a code verifier you generate yourself.
Advanced
2 lessonsRequests that prove they weren't changed, and testing who is allowed to do what.