Stop 08 · API TestingTopics · 6/9

Authentication Testing (OAuth, API Keys)

In short

If the wrong person can read someone else's orders, nothing else about the API matters. Auth tests check that every door is locked to the right people.

Verifying that API authentication is correctly enforced — valid credentials work, invalid ones are rejected, and expired tokens are handled properly — a security-adjacent but standard QA responsibility.

The purple blob in a guard's cap checks an ID card at a desk beside a closed gate.

Think of it like this

The hostel gate guard

Valid hostel ID? Come in. No ID? Stop. Last year's expired card? Stop. Boys' hostel card at the girls' hostel? Stop. A good guard checks each case. Your auth tests are the guard's training drill.

Watch it happen

Four doors to test

Tester

Orders API

GET /orders (no token)

1/6No credentials at all. The API must refuse.

The big ideas

What you need to know

API keys

A long secret sent in a header like x-api-key. Identifies the app, not usually the person.

OAuth 2.0 tokens

You log in once and get a short-lived access token, sent as Authorization: Bearer on each call.

Expiry and refresh

Test expired, revoked and malformed tokens. Each should be rejected cleanly.

Only with permission

Run auth tests on your own app or QA environment. Probing systems you don't own is illegal.

See it in code

Walk through the code

python

1import requests2 3URL = "https://httpbin.org/bearer"  # practice endpoint4 5def test_missing_token_is_rejected():6    r = requests.get(URL, timeout=10)7    assert r.status_code == 4018 9def test_valid_bearer_token_is_accepted():10    headers = {"Authorization": "Bearer my-test-token"}11    r = requests.get(URL, headers=headers, timeout=10)12    assert r.status_code == 20013    assert r.json()["authenticated"] is True

1/3No Authorization header at all should give 401.

httpbin.org/bearer accepts any bearer token, so it's only for practising the shape of auth tests.

Save yourself the pain

Common mistakes

Oops

Only testing with a valid admin token, because that's what's in Postman.

Do this instead

Test no token, expired, malformed, and a normal user trying admin actions.

Oops

Committing real API keys or tokens into the test repo.

Do this instead

Read secrets from environment variables or a vault, never from code.

Your mission

Run an auth drill

~30 min

Quick check

User A's valid token successfully returns User B's private profile. What kind of bug is this?

Go deeper

1Test an API with valid credentials, invalid credentials, and no credentials, comparing responses.
2Learn the basic OAuth flow conceptually, since it's the most common modern API auth scheme.
3Understand why testing authentication failure cases is as important as testing successful access.