What are different API Authentication methods?

1. Basic Authentication:

• Username and password encoded in Base64
• Sent in Authorization header
• Format: Authorization: Basic base64(username:password)
• Pros: Simple to implement
• Cons: Not secure without HTTPS

2. API Key:

• Unique key assigned to each client
• Sent in header, query parameter, or body
• Example: X-API-Key: your-api-key-here
• Pros: Easy to implement and revoke
• Cons: Can be exposed if not handled properly

3. Bearer Token (JWT):

• JSON Web Token containing encoded claims
• Format: Authorization: Bearer <token>
• Self-contained with expiration
• Pros: Stateless, scalable
• Cons: Cannot revoke before expiration

4. OAuth 2.0:

• Industry-standard authorization framework
• Uses access tokens and refresh tokens
• Multiple grant types (authorization code, client credentials)
• Pros: Secure, widely adopted
• Cons: Complex to implement

Testing Authentication

• Test with valid credentials
• Test with invalid/expired tokens
• Test without authentication
• Test token refresh mechanism
• Verify proper error messages (401, 403)