Most real APIs require you to prove your identity before they respond. Understanding the common authentication schemes is essential, because many API test failures are simply auth problems in disguise.
Common schemes
- API keys — a secret token sent with each request (often in a header). Simple, but less granular.
- OAuth 2.0 — a delegation framework where the client obtains an access token from an authorisation server, then uses it to call the API. Common for third-party access.
- JWT (JSON Web Token) — a signed, self-contained token carrying claims about the user; often used as the access token in OAuth flows.
Token-based authentication
Authenticate get token
→
Send token Authorization header
→
API grants access
Test ideas: verify that missing or invalid credentials return 401, that a valid token grants access, that expired tokens are rejected, and that a user cannot access another user's data (403).
Conclusion
API keys, OAuth 2.0, and JWT are the authentication schemes you will meet most often. Knowing how each proves identity — and testing both the allowed and denied paths — is critical for secure, correct APIs.