API Key Authentication

How it works

An API key is a long-lived secret that identifies the calling application rather than a user. There is no login step and usually no expiry: the client attaches the same key to every call, most often in a custom header. testkru expects it in X-API-Key.

Since the key is just a header, REST Assured needs nothing special: header() on the request specification is enough. HTTP header names are not case-sensitive, and a lower-case x-api-key is accepted just the same. A key in the wrong place is not: sent as a query parameter it is ignored and the server answers 401.

The 401 body on this endpoint is unusually helpful, because it is a practice API: the error message tells you which header to send. On success you get a message confirming the key and a key field that echoes it back, which lets the test prove the server read the value you sent.

About the assignment

Call the API key endpoint with the course key in the expected header and print the status, the confirmation message and the key the server read.

What you will do

1. 1Add an X-API-Key header with the key from the starter comment using header().
2. 2GET /auth/apikey and keep the Response.
3. 3Print the status code after Status:.
4. 4Print the message field after Message: and the key field after Key:.

Common mistakes

• Sending the key as a query parameter

  queryParam() puts it in the URL, where this server does not look, and the call fails with 401. Keys in URLs also end up in server and proxy logs, which is why headers are preferred.

• Using auth() for a key

  The auth() helpers produce Authorization headers for Basic, digest or OAuth schemes. An API key in a custom header is not one of them.

• Hard-coding real keys

  Fine for this sandbox, but a real key committed to a test file leaks to everyone with repository access. Read it from the environment.

In a real test suite

Related lessons

• Headers SpecificationPuts this same X-API-Key header into a reusable request specification.
• Echo Request HeadersSends custom request headers and reads them back from an echo.
• Basic AuthenticationCompares with Basic auth, which uses the standard Authorization header.

To try one of these calls on any API endpoint without a task, open the Online Selenium Java Compiler (REST Assured is included).

Starter code

The editor above opens with this code. Fill in the TODO lines, then run and submit it.

import io.restassured.RestAssured;
import io.restassured.response.Response;
import io.restassured.specification.RequestSpecification;
import static io.restassured.RestAssured.*;

public class Main {
    public static void main(String[] args) {
        RestAssured.baseURI = "https://testkru.com/api";

        // TODO: GET /auth/apikey with header X-API-Key = "testkey123"
        // TODO: Print status, message, and key
    }
}