What you will learn
Authentication says who or what is calling. Basic authentication sends a username and password. An API key is a different header. Neither one encrypts itself. HTTPS protects the connection. A successful call does not say which customer records are allowed.
Your goals
- Send valid and missing credentials for two different mechanisms.
- Report a secret in an error without copying it.
Before you start
Read the previous lesson first if you have not already. This course does not require programming.
Practice setup
These requests use the public TestKru teaching API. No workspace is needed unless a step says so. Leave the body empty for GET, HEAD and OPTIONS. Example people and emails are fictional. Changes to /api/users are simulated and are not saved.
Follow these steps
- Send GET https://testkru.com/api/auth/basic with the teaching Basic credentials from the API reference. Select that response.
- Send the same URL with no Authorization header. Select that response. Read the message and do not copy the password into your answer.
- Send GET https://testkru.com/api/auth/apikey with the teaching X-API-Key value, then send it again with no key. Select both responses.
- Choose what the error body does with the practice secret.
- Submit Answers. A successful credential still does not prove which customer record you may read.
Investigate before concluding
First record the actual result for each case. Compare the body, headers and later state with the stated contract. Keep an observation separate from a prediction; use the model answer only after making your own attempt.
What to keep as evidence
- Both mechanisms have a success and a missing-credential request.
- The key is not placed in the URL.
- The disclosure answer does not contain the secret.
References for this lesson
Finish this assignment
Select each named response with Use this response. Answer from those responses or the transcript on this page. Click Submit Answers. Your score is the percentage of checks that passed. Core checks are required to finish. Extra evidence checks are labelled. A saved 100/100 means every check passed. Continue opens the next lesson you can submit.
If something goes wrong
- Change one part of the request at a time. If a check needs attention, read the note under it and compare it with the response you selected.
Self-review and independent variation
- Both mechanisms have a success and a missing-credential request.
- The key is not placed in the URL.
- The disclosure answer does not contain the secret.
Describe Basic authentication as encoding, and HTTPS as the protection for the connection.
Automatic checks verify the requests and answers configured for this lesson. The self-review is for your own reasoning. A score is not a certificate.