Authentication
API keys, JWT, OAuth2, token refresh — auth flows explained with runnable code.
beginner·6 min
API Keys: The Simplest Authentication That Still Trips People Up
Simple, common, and surprisingly easy to get wrong. Here's the API key playbook.
api keysapi key authenticationapi key security
intermediate·8 min
JWT Authentication: What's Inside the Token and How to Test It
JWTs pack auth and user context into a signed string. Simple on the surface, full of traps underneath.
jwt authenticationjson web tokenjwt security
intermediate·8 min
OAuth 2.0 Client Credentials: Machine-to-Machine Auth Done Right
OAuth 2.0's machine-to-machine flow. Clean, standard, and easy to test once you see the shape.
oauth 2.0client credentialsoauth client credentials
intermediate·7 min
Token Refresh Patterns: Rotating, Sliding, and Reactive Refresh
Short-lived access tokens need graceful refresh. Three common patterns, one big pitfall.
token refreshrefresh tokentoken rotation
Practice on your own APIs — free forever
Apply these authentication lessons in Shift-Left Studio.
The Citizen Developer Edition is forever-free for one user — generate tests with AI, mock APIs, and run workflows on your own services. The fastest way to keep growing your testing skills after a lesson.