How do I test OAuth and JWT auth flows on APIs?

To test OAuth and JWT authentication flows on APIs, you usually want to verify both the happy path and failure cases across the full lifecycle: obtaining tokens, using them, refreshing them, and handling expiry/invalid tokens.

1) Understand which auth flow you’re testing

Common cases:

• OAuth 2.0 Authorization Code Flow
  Typical for user-based login.
• OAuth 2.0 Client Credentials Flow
  Typical for server-to-server/API-to-API access.
• JWT Bearer Token auth
  API expects a signed JWT in Authorization: Bearer <token>.
• OpenID Connect (OIDC)
  OAuth plus identity token (id_token) if you’re testing login/identity.

2) Test the token acquisition step

Verify you can get a token from the auth server/identity provider.

What to check

• Correct client credentials / authorization code / redirect URI
• Scope handling
• Token endpoint response codes
• Token structure and claims

Example checks

• Access token is returned
• Refresh token is returned when expected
• expires_in is present and reasonable
• JWT is correctly signed and has expected claims:
  • iss
  • sub
  • aud
  • exp
  • iat
  • scope or scp

3) Test API access with the token

Send the access token to protected endpoints.

Example request

curl -H "Authorization: Bearer <access_token>" \
  https://api.example.com/v1/profile

Verify

• Valid token returns 200 OK
• Missing token returns 401 Unauthorized
• Expired token returns 401 Unauthorized
• Insufficient scope returns 403 Forbidden
• Wrong audience or issuer is rejected

4) Test JWT validation rules

If your API validates JWTs directly, confirm it checks:

• Signature with the correct public key / secret
• Issuer (iss)
• Audience (aud)
• Expiration (exp)
• Not-before (nbf)
• Issued-at (iat) if applicable
• Algorithm restrictions
  Only allow expected algorithms like RS256; reject unexpected ones like none

Negative test cases

Try tokens that are:

• Expired
• Tampered with
• Signed with the wrong key
• Missing required claims
• Using the wrong audience
• Using the wrong algorithm

5) Test refresh token flow

If refresh tokens are supported:

• Use refresh token to obtain a new access token
• Verify old access token expires as expected
• Verify refresh token rotation if implemented
• Verify revoked refresh tokens can’t be reused

6) Test scope/role-based authorization

Authentication is not authorization. A token may be valid but still lack permission.

Check

• Different scopes/roles can access only allowed endpoints
• Least privilege is enforced
• Unauthorized actions return 403

Example:

• read:orders can list orders
• write:orders can create orders
• admin can access admin endpoints only

7) Automate tests

Use tools like:

• Postman / Newman
• curl + shell scripts
• pytest / requests
• JUnit / RestAssured
• k6 / JMeter for auth under load
• OWASP ZAP for security testing

Postman ideas

• Pre-request script to fetch token
• Environment variable to store access token
• Tests asserting status codes and claims

8) Security-focused tests

Important security cases:

• Token leakage in logs
• Token replay protection if applicable
• HTTPS required
• CORS behavior for browser-based OAuth flows
• PKCE required for public clients
• Client secret not exposed in frontend apps
• Token revocation and logout behavior

9) Example test matrix

Test	Expected
Valid access token	200
No token	401
Expired token	401
Wrong audience	401
Invalid signature	401
Missing scope	403
Revoked token	401
Refresh token exchange	200 new access token

10) Practical approach

A good testing sequence is:

1. Request a token from the auth server
2. Decode JWT and inspect claims
3. Call protected API with token
4. Test expiry/revocation/invalid token cases
5. Test authorization via scopes/roles
6. Automate in CI

If you want, I can also give you:

• a Postman collection example
• a Python test script
• or a JWT decoding/validation checklist for your specific flow.