API key authentication in Postman - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

What is the response status code when API key is missing?

You send a GET request to an API endpoint that requires an API key in the header X-API-Key. You omit this header. What is the expected HTTP status code in the response?

Postman

GET /data HTTP/1.1
Host: api.example.com

A 500 Internal Server Error

B 200 OK

C 401 Unauthorized

D 403 Forbidden

💡 Hint

Think about what status code means 'authentication required but missing or invalid'.

When an API key is missing, the server responds with 401 Unauthorized to indicate authentication is required.

❓ assertion

intermediate

Which assertion correctly verifies API key authentication success?

You have a Postman test script that checks if the API key authentication succeeded by verifying the response status code is 200. Which assertion is correct?

Postman

pm.test('API key auth success', function() {
    // Fill in assertion here
});

A pm.response.to.have.status(200);

B pm.response.to.have.status(401);

C pm.response.to.have.status(403);

D pm.response.to.have.status(500);

💡 Hint

Success means the server accepted the API key and returned OK.

Status code 200 means the request was successful, so the assertion checks for 200.

❓ locator

advanced

Identify the best header locator for API key in Postman test script

In a Postman test script, you want to check the value of the API key sent in the request header X-API-Key. Which code correctly accesses this header?

A pm.response.headers.get('X-API-Key')

B pm.response.getHeader('X-API-Key')

C pm.request.getHeader('X-API-Key')

D pm.request.headers.get('X-API-Key')

💡 Hint

Request headers are accessed from pm.request.headers.

To get a request header value, use pm.request.headers.get('Header-Name'). Response headers are different.

🔧 Debug

advanced

Why does this Postman test fail to detect missing API key?

Here is a Postman test script snippet:

pm.test('API key present', function() {
    pm.expect(pm.request.headers.get('X-API-Key')).to.not.be.undefined;
});

But the test passes even when the API key header is missing. Why?

A pm.request.headers.get throws an error if header is missing

B pm.request.headers.get returns null, not undefined, when header is missing

C pm.expect cannot check undefined values

D The header name is case-sensitive and should be lowercase

💡 Hint

Check what value pm.request.headers.get returns if header is absent.

When the header is missing, pm.request.headers.get returns null, not undefined, so the test condition is true and test passes incorrectly.

❓ framework

expert

Which Postman pre-request script correctly sets API key header from environment variable?

You want to add an API key stored in the environment variable API_KEY to the request header X-API-Key before sending the request. Which script does this correctly?

A pm.request.headers.upsert({key: 'X-API-Key', value: pm.environment.get('API_KEY')});

B pm.request.headers.set('X-API-Key', pm.environment.get('API_KEY'));

C pm.request.headers.add({key: 'X-API-Key', value: pm.environment.get('API_KEY')});

D pm.request.headers.append({key: 'X-API-Key', value: pm.environment.get('API_KEY')});

💡 Hint

Use the method that adds or updates a header correctly in Postman scripts.

upsert adds the header if missing or updates it if present. Other methods either don't exist or don't update properly.