Skip to main content
2026-07-29 16:01
REST API

Bearer Token (JWT)

AuthRequestValidateMedium
Try Interactive Demo

What you will learn

  • Validate JWT signature AND expiration — a well-formed but expired token must be rejected
  • Test the algorithm-none attack: forged tokens with `alg: none` must never authenticate
  • Separate authentication (who) from authorization (can they) — 401 vs 403 errors

Description

Authenticate using JWT token in Authorization header. Verify token structure.

Test Scenario

// Login to get token
const login = await request.post('/api/v1/auth/login', {
  data: { email: 'test@example.com', password: 'password123' }
});
// login wraps its payload in the envelope: { success, data: { token, user } }
const { data } = await login.json();
const token = data.token;

// Use token against a protected endpoint (/auth/me)
const response = await request.get('/api/v1/auth/me', {
  headers: { 'Authorization': 'Bearer ' + token }
});
expect(response.status()).toBe(200);
Endpoint/api/v1/auth/me

Testing Tips

  • •First obtain token via login
  • •Set Authorization: Bearer <token>
  • •Check token expiration handling
// Playwright - Bearer Token Auth
import { test, expect } from '@playwright/test';


test('Bearer Token Authentication', async ({ request }) => {
  // First login to get token
  const loginResponse = await request.post('/api/v1/auth/login', {
    data: { email: 'user@example.com', password: 'password123' }
  });
  // login wraps its payload: { success, data: { token, user } }
  const { data } = await loginResponse.json();
  const token = data.token;


  // Use token for protected endpoint
  const response = await request.get('/api/v1/auth/me', {
    headers: {
      'Authorization': `Bearer ${token}`
    }
  });


  expect(response.ok()).toBeTruthy();
  const body = await response.json();
  expect(body.data.email).toBe('user@example.com');
});

Challenge ID: rest-auth-bearer

2 frameworks available

API Playground

Send requests and inspect responses

Endpoint: /api/v1/auth/me

Press Enter to send