API Authentication in REST Assured

Basic, Bearer Token, OAuth 2.0, API Key, and JWT

Authentication is one of the most important aspects of API testing. Before accessing protected resources, APIs must verify the identity of the client. Here we learn API Authentication in REST Assured. In this guide, you’ll learn how to implement the five most common authentication methods in REST Assured.

1. Basic Authentication

Basic Authentication sends a username and password encoded in Base64 with every request. Although simple, it should always be used over HTTPS.

import static io.restassured.RestAssured.*;
given()
    .auth()
    .preemptive()
    .basic("username", "password")
.when()
    .get("https://api.example.com/users")
.then()
    .statusCode(200);

Best for: Internal APIs, legacy systems, and simple authentication scenarios.

2. Bearer Token Authentication

Bearer authentication uses an access token in the Authorization header after a user has successfully authenticated.

String token = "your_access_token";
given()
    .header("Authorization", "Bearer " + token)
.when()
    .get("https://api.example.com/profile")
.then()
    .statusCode(200);

Best for: Modern REST APIs that issue access tokens after login.

3. OAuth 2.0 Authentication

REST Assured provides built-in support for OAuth 2.0 by automatically adding the Bearer token.

String accessToken = "oauth_access_token";
given()
    .auth()
    .oauth2(accessToken)
.when()
    .get("https://api.example.com/userinfo")
.then()
    .statusCode(200);

Best for: Enterprise APIs, Google APIs, Microsoft APIs, GitHub APIs, and other OAuth-secured services.

4. API Key Authentication

Many public APIs require an API key, which can be passed as a header or query parameter.

API Key in Header

given()
    .header("x-api-key", "your_api_key")
.when()
    .get("https://api.example.com/data")
.then()
    .statusCode(200);

API Key as Query Parameter

given()
    .queryParam("apiKey", "your_api_key")
.when()
    .get("https://api.example.com/data")
.then()
    .statusCode(200);

Best for: Public APIs, weather services, payment gateways, and third-party integrations.

5. JWT Authentication Testing

A JSON Web Token (JWT) is commonly used for stateless authentication. After logging in, the server returns a JWT that must be included in subsequent requests.

String jwtToken = "eyJhbGciOiJIUzI1NiIs...";
given()
    .header("Authorization", "Bearer " + jwtToken)
.when()
    .get("https://api.example.com/orders")
.then()
    .statusCode(200);

You can also extract the JWT from a login response and reuse it:

String token =
given()
    .contentType("application/json")
    .body("""
        {
          "username":"admin",
          "password":"password123"
        }
        """)
.when()
    .post("https://api.example.com/login")
.then()
    .extract()
    .path("token");
given()
    .header("Authorization", "Bearer " + token)
.when()
    .get("https://api.example.com/orders")
.then()
    .statusCode(200);

Best for: Modern web applications, microservices, and stateless REST APIs.

Choosing the Right Authentication Method

Conclusion

REST Assured provides simple and fluent APIs for testing every major authentication mechanism. Whether you’re working with Basic Authentication, Bearer Tokens, OAuth 2.0, API Keys, or JWTs, you can easily authenticate requests and validate secured endpoints using just a few lines of Java code.

Mastering these authentication techniques is essential for building reliable API automation frameworks and testing real-world REST APIs.

Related Articles

• What is API Testing
• REST HTTP Methods
• What is REST Assured
• Rest Assured Page
• Setup REST Assured
• First REST Assured Test
• REST Assured Request Specification
• E2E API Testing Flow in REST Assured
• Response Validation in REST Assured