Mid-LevelAPI & Integration Testing
How do you test API authentication and authorization?
- authentication
- authorization
- security testing
Answer it first, then compare. Nothing here is saved or scored.
Model answer
Authentication tests: valid token returns 200, expired token returns 401, missing token returns 401, malformed token returns 401. Authorization tests: user A cannot access user B's resources (403), role-based access (admin vs. user), resource-level permissions. Test with multiple user roles and verify each endpoint enforces the correct access level. Also test token refresh flows and session expiration.
What interviewers listen for
- Schema-first thinkingYou validate response shape before you assert on values, every time.
- Status-code literacyYou can defend why 401 vs 403 vs 422 matters for the consumer.
- Contract awarenessYou know when consumer-driven contract tests beat end-to-end checks.
- Auth fluencyYou can describe rotating tokens across parallel workers without secrets in logs.