26 / 65 · 14 API Testing Fundamentals · Authentication Testing← prev⊞ allnext →☰ Read as one page
4.2Authentication Methods
| Method | How It Works | Common In |
|---|---|---|
| API Key | Static key in header or query param | Third-party integrations, internal APIs |
| OAuth 2.0 | Token exchange flow (authorization code, client credentials) | SaaS platforms, social login |
| JWT | Self-contained signed token with claims | Modern APIs, microservices |
| Session Cookie | Server-side session with cookie ID | Traditional web apps |
| Basic Auth | Base64-encoded username:password in header | Legacy APIs, simple internal tools |