认证方式
认证方式:每种常见方式一个端点(Basic、Bearer、放在请求头/查询参数/Cookie 中的 API 密钥、Digest、HMAC 请求签名、角色和 scope 检查、双重提交 CSRF),用于测试客户端如何发送凭据。所有凭据都是固定的,由 GET /api/auth 列出。认证方式:每种常见方式一个端点(Basic、Bearer、放在请求头/查询参数/Cookie 中的 API 密钥、Digest、HMAC 请求签名、角色和 scope 检查、双重提交 CSRF),用于测试客户端如何发送凭据。所有凭据都是固定的,由 GET … 列出。
你的账号已解锁这些端点。在每个端点的页面上用 Try it 发送请求。
- GET
https://api.testingapis.com/api/authList every auth scheme with its test credentialsList every auth scheme with its test credentials. - GET
https://api.testingapis.com/api/auth/api-key/cookieAuthenticate with an API key in the api_key cookieAuthenticate with an API key in the api_key cookie. - GET
https://api.testingapis.com/api/auth/api-key/headerAuthenticate with an API key in the X-API-Key headerAuthenticate with an API key in the X-API-Key header. - GET
https://api.testingapis.com/api/auth/api-key/queryAuthenticate with an API key in the api_key query parameterAuthenticate with an API key in the api_key query parameter. - GET
https://api.testingapis.com/api/auth/basicAuthenticate with HTTP Basic authAuthenticate with HTTP Basic auth. - GET
https://api.testingapis.com/api/auth/basic-hidden/{user}/{pass}Authenticate with Basic auth, returning 404 instead of 401 on failureAuthenticate with Basic auth, returning 404 instead of 401 on failure. - GET
https://api.testingapis.com/api/auth/basic/{user}/{pass}Authenticate with Basic auth against credentials taken from the URLAuthenticate with Basic auth against credentials taken from the URL. - GET
https://api.testingapis.com/api/auth/bearerAuthenticate with a static bearer tokenAuthenticate with a static bearer token. - POST
https://api.testingapis.com/api/auth/csrf/submitSubmit a CSRF-protected formSubmit a CSRF-protected form (double-submit cookie check). - GET
https://api.testingapis.com/api/auth/csrf/tokenIssue a CSRF token and set it as the XSRF-TOKEN cookieIssue a CSRF token and set it as the XSRF-TOKEN cookie. - GET
https://api.testingapis.com/api/auth/digestAuthenticate with HTTP Digest authAuthenticate with HTTP Digest auth (MD5, qop=auth). - POST
https://api.testingapis.com/api/auth/hmacVerify an HMAC-SHA256 request signatureVerify an HMAC-SHA256 request signature. - GET
https://api.testingapis.com/api/auth/roles/adminAllow only tokens with the admin roleAllow only tokens with the admin role (401 vs 403 demo). - DELETE
https://api.testingapis.com/api/auth/roles/resourceAllow only tokens with the delete scopeAllow only tokens with the delete scope. - GET
https://api.testingapis.com/api/auth/roles/userAllow only tokens with the user roleAllow only tokens with the user role.
请求示例
List every auth scheme with its test credentials. 完整参考和 Send 按钮(英文).
cURL
curl -X GET "https://api.testingapis.com/api/auth"响应 · 200 OK
{
"message": "Hardcoded credentials for every auth scheme. Send them wrong to test your 401 handling; the role endpoints also return 403.",
"schemes": [
{
"scheme": "basic",
"endpoint": "GET /api/auth/basic",
"credentials": {"username": "apibee", "password": "password123"}
},
{
"scheme": "basic (path creds)",
"endpoint": "GET /api/auth/basic/{user}/{pass}",
"credentials": "Any user/pass — must match the path"
},
"… 12 more items"
… (2 more lines)