๐Ÿ” API Authentication โ€” Visual Flows

๐Ÿ‘‰ Try the interactive playground

1๏ธโƒฃ Basic Auth

CLIENT SERVER GET /basic Authorization: Basic base64(user:pass) ๐Ÿ” decode base64 ๐Ÿ” check USERS[user] == pass 200 OK { "message": "Hello alice!" }

2๏ธโƒฃ API Key Auth

CLIENT SERVER GET /apikey X-API-Key: student123 ๐Ÿ” key == API_KEY ? 200 OK { "message": "Access granted" }

3๏ธโƒฃ JWT Auth (2-step)

CLIENT SERVER POST /login { user, pass } ๐Ÿ” verify credentials ๐Ÿ” sign JWT with SECRET_KEY 200 OK { token: "eyJhbGci..." } GET /jwt Authorization: Bearer eyJhbGci... ๐Ÿ” verify signature ๐Ÿ” check exp not expired 200 OK { "message": "Hello alice!" }

๐Ÿ“– HTTP status codes used in this API

CodeMeaningExample
200โœ… OKSuccessful auth
400โš ๏ธ Bad RequestMissing username/password in /login
401๐Ÿ”’ UnauthorizedWrong password, bad API key, expired JWT
404๐Ÿšซ Not FoundUnknown URL
405๐Ÿšซ Method Not AllowedGET on /login (POST only)
500๐Ÿ’ฅ Server ErrorUnhandled exception

๐Ÿงช Try it (curl)

# Basic curl -u alice:password123 http://140.245.218.78/basic # API Key curl -H "X-API-Key: student123" http://140.245.218.78/apikey # JWT โ€” step 1: login curl -X POST http://140.245.218.78/login \ -H "Content-Type: application/json" \ -d '{"username":"alice","password":"password123"}' # JWT โ€” step 2: use token curl -H "Authorization: Bearer <TOKEN>" http://140.245.218.78/jwt # Peek inside a JWT curl -X POST http://140.245.218.78/debug/jwt \ -H "Content-Type: application/json" \ -d '{"token":"<TOKEN>"}'

โŒ Failure cases (learn what "wrong" looks like)

# Wrong password โ†’ 401 curl -u alice:WRONG http://140.245.218.78/basic # Missing header โ†’ 401 curl http://140.245.218.78/basic # Bad API key โ†’ 401 curl -H "X-API-Key: nope" http://140.245.218.78/apikey # Tampered JWT โ†’ 401 curl -H "Authorization: Bearer eyJhbGci.TAMPERED.xxx" http://140.245.218.78/jwt # No Bearer prefix โ†’ 401 curl -H "Authorization: <TOKEN>" http://140.245.218.78/jwt