🔐 Authentication

Authentication: API authentication is like a bank vault's dual-key lock: to open it, the bank manager's key (server secret) and your key (token/API key) must both turn simultaneo

API authentication is like a bank vault's dual-key lock: to open it, the bank manager's key (server secret) and your key (token/API key) must both turn simultaneously — neither works without the other. You might say you already type the token in Postman's Authorization tab; why write `.auth().bearer(token)` in REST Assured? Because Postman's auth setting is scoped to that collection and is not wired into CI/CD; in REST Assured the token comes from an environment variable fetched in `@BeforeAll` in BaseTest, and it rotates securely every time the pipeline fires. In Java, testing with Spring Security's `@WithMockUser` bypasses the real HTTP layer — REST Assured's `.auth().oauth2(token)` sends the token over actual HTTP and tests the API's real auth middleware. The critical QA risk: if you hardcode a token in your test, when that token expires you break the entire test suite — worse, the CI pipeline breaks at 3 AM and the team panics in the morning. `System.getenv("API_TOKEN")` eliminates that risk entirely.

Basic Authentication

Micro Lab: REST Assured assertion writing

Replace the TODO line with the critical line from the expected solution. This is not a real runtime; the goal is to reinforce writing the correct structure in a controlled way.

Without preemptive(), Why Does the First Request Make an Extra Round-Trip?

.auth().basic("admin"…

`.auth().basic("admin", "secret123")` CONVERTS the "username:password" text to Base64 and ADDS it as the `Authorization: Basic ...` header — this is encoding, NOT encryption.

PLAIN .basic() sends a request WITHOUT…

PLAIN `.basic()` sends a request WITHOUT auth FIRST, the server returns 401, THEN it retries WITH auth — this MEANS 2 round-trips.

.preemptive() SKIPS this waiting game…

`.preemptive()` SKIPS this waiting game — it sends the auth header on the VERY FIRST request, the server never returns 401.

Result: 1 FEWER HTTP round-trip per test = a faster test suite AND no unnecessary 401 noise in server logs.

Bearer Token — Login → Get Token → Use It

How Is the Login Token Shared Across All Test Methods?