Bearer Token Authentication

How it works

Bearer authentication means "whoever bears this token gets access". The client sends Authorization: Bearer followed by the token, and the server checks the signature and expiry instead of looking up a password. testkru tokens are signed with HMAC-SHA256 and expire one hour after login.

The real-world flow is a chain of two requests, and REST Assured makes the first one feed the second. then().extract().path("token") pulls a single value straight out of the login response as a String, without creating a separate JsonPath object.

For the second call you can build the header yourself with header(), or let REST Assured do it: auth().oauth2(token) sends exactly the same Authorization: Bearer header, and the protected endpoint accepts it. A token that is malformed or expired gets 401 with a message telling you to fetch a fresh one. On success the endpoint returns a message and the user taken from the token's sub claim.

About the assignment

Log in, keep the token, then use it to reach the protected endpoint and print what that endpoint returns.

What you will do

1. 1POST the course credentials to /auth/login as JSON and use then().extract().path() to keep the token value in a String.
2. 2Send a GET to /auth/protected carrying that token as a Bearer credential, either through header() with the Bearer prefix or through auth().oauth2().
3. 3Print the status code after Status:.
4. 4Print the message and user fields after Message: and User:.

Common mistakes

• Forgetting the Bearer prefix or the space

  With header() you build the whole value yourself. A bare token, or Bearer with no space before the token, is not recognised and the server replies 401 as if nothing was sent.

• Extracting the wrong field

  The login body has two fields. Taking user instead of token sends the word admin as a token. It is not a three-part JWT, so the server rejects it as invalid with a 401.

• Caching a token too long

  A token stored in a static field across a long run expires after an hour. Real suites refresh it, or log in again when a call returns 401.

In a real test suite

Related lessons

• JWT LoginThe login call on its own, checking that a token comes back.
• Handle 401 UnauthorizedCalls the same protected endpoint without a token and handles the 401.
• API Workflow - Authentication and OrderChains login and a POST that carries the token into one workflow.

To try one of these calls on any API endpoint without a task, open the Online Selenium Java Compiler (REST Assured is included).

Starter code

The editor above opens with this code. Fill in the TODO lines, then run and submit it.

import io.restassured.RestAssured;
import io.restassured.response.Response;
import io.restassured.specification.RequestSpecification;
import io.restassured.http.ContentType;
import static io.restassured.RestAssured.*;

public class Main {
    public static void main(String[] args) {
        RestAssured.baseURI = "https://testkru.com/api";

        // Step 1: Login to get the token
        // TODO: POST to /auth/login, extract the "token" field

        // Step 2: Access the protected resource
        // TODO: GET /auth/protected with header "Authorization" = "Bearer " + token
        // TODO: Print status, message, and user
    }
}