Skip to main content
2026-07-29 16:01
REST API

API Key Authentication

AuthRequestValidateEasy
Try Interactive Demo

What you will learn

  • API key in header (X-API-Key) is standard — query-string (?apikey=) leaks into access logs, referer, and shared URLs
  • Test key rotation: old key must 401 immediately after rotation, not eventually
  • Scope keys per principal (not per environment) — an unscoped key leak is an org-wide incident

Description

Authenticate using API key in header or query parameter.

Test Scenario

const response = await request.get('/api/v1/auth/apikey', {
  headers: { 'X-API-Key': 'test-api-key-123' }
});
expect(response.status()).toBe(200);
Endpoint/api/v1/auth/apikey

Testing Tips

  • •Use X-API-Key header
  • •Or use ?api_key= query param
  • •Check different key permissions
// Playwright - API Key Auth
import { test, expect } from '@playwright/test';


test('API Key in Header', async ({ request }) => {
  const response = await request.get('/api/v1/auth/apikey', {
    headers: {
      'X-API-Key': 'test-api-key-123'
    }
  });


  expect(response.ok()).toBeTruthy();
});


test('API Key in Query Param', async ({ request }) => {
  const response = await request.get('/api/v1/auth/apikey?api_key=test-api-key-123');
  expect(response.ok()).toBeTruthy();
});

Challenge ID: rest-auth-apikey

2 frameworks available

API Playground

Send requests and inspect responses

Endpoint: /api/v1/auth/apikey

Press Enter to send