Bearer tokens: missing credentials versus expiry

What you will learn

A bearer token grants access to whoever presents it. Copy it from the login response into the Authorization header. It is not your CodeKru sign-in token. Editing the token text breaks it. That is not the same thing as waiting until it expires.

Your goals

• Call a protected URL with the access token and without it.
• Tell a damaged token apart from an expired token.

Before you start

Read the previous lesson first if you have not already. This course does not require programming.

Practice setup

These requests use the public TestKru teaching API. No workspace is needed unless a step says so. Leave the body empty for GET, HEAD and OPTIONS. Example people and emails are fictional. Changes to /api/users are simulated and are not saved.

Follow these steps

1. Send POST https://testkru.com/api/auth/login with the teaching username and password from the API reference. Copy the token field. Do not copy it into your notes.
2. Send GET https://testkru.com/api/auth/protected with header Authorization: Bearer and that token. Select that response.
3. Send the same URL with no Authorization header. Select that response.
4. Choose what editing a token by hand would prove.
5. Submit Answers. This lesson does not include a real expired token. Do not change the token text and call the result expiry.

Investigate before concluding

First record the actual result for each case. Compare the body, headers and later state with the stated contract. Keep an observation separate from a prediction; use the model answer only after making your own attempt.

What to keep as evidence

• The token is placed in the Authorization header.
• The missing-token request uses the same URL.
• Expiry is not confused with a damaged token.

Finish this assignment

Select each named response with Use this response. Answer from those responses or the transcript on this page. Click Submit Answers. Your score is the percentage of checks that passed. Core checks are required to finish. Extra evidence checks are labelled. A saved 100/100 means every check passed. Continue opens the next lesson you can submit.