Bearer token in Postman - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Bearer Token Usage in API Requests

Which statement best describes the purpose of a Bearer token in API testing?

A It is a token that encrypts the entire API request body for security.

B It is a token used to authenticate API requests by including it in the Authorization header.

C It is a token that specifies the API endpoint URL to be accessed.

D It is a token that logs the user out of the API session automatically.

💡 Hint

Think about how APIs verify who is making the request.

A Bearer token is sent in the Authorization header to prove the request is from an authenticated user or system.

❓ Predict Output

intermediate

What is the result of this Postman test script?

Given this Postman test script, what will be the value of pm.environment.get('authStatus') after running?

Postman

pm.test('Check status code', function () {
    pm.response.to.have.status(200);
    if (pm.response.code === 200) {
        pm.environment.set('authStatus', 'success');
    } else {
        pm.environment.set('authStatus', 'fail');
    }
});

A "success" if response status is 200, otherwise "fail"

B "fail" always because pm.response.code is undefined

C "success" always regardless of response status

D Throws an error because pm.environment.set is not a function

💡 Hint

Check how the script sets environment variables based on response code.

The script sets 'authStatus' to 'success' only if the response code is 200, otherwise 'fail'.

❓ assertion

advanced

Choose the correct assertion to verify Bearer token presence

Which Postman test assertion correctly checks that the Authorization header contains a Bearer token?

A pm.test('Bearer token present', () => pm.request.headers.has('Authorization') && pm.request.headers.get('Authorization').includes('Bearer'));

B pm.test('Bearer token present', () => pm.response.headers.has('Authorization') && pm.response.headers.get('Authorization').startsWith('Bearer '));

C pm.test('Bearer token present', () => pm.request.headers.get('Authorization').startsWith('Bearer '));

D pm.test('Bearer token present', () => pm.response.headers.get('Authorization').includes('Bearer'));

💡 Hint

Remember that the Bearer token is sent in the request headers, not response headers.

The Bearer token is part of the request's Authorization header. Option C correctly checks the request headers for 'Authorization' and verifies it starts with 'Bearer '.

🔧 Debug

advanced

Identify the error in this Bearer token test script

What error will this Postman test script produce?

Postman

pm.test('Check Bearer token', () => {
    const authHeader = pm.request.headers.get('Authorization');
    pm.expect(authHeader).to.match(/^Bearer\s\w+$/);
});

A No error, test passes always

B SyntaxError due to incorrect regex escape sequences

C TypeError because pm.request.headers.get is not a function

D AssertionError if Authorization header is missing or malformed

💡 Hint

Consider what happens if the Authorization header is missing or empty.

If the Authorization header is missing or does not match the regex, the assertion fails causing an AssertionError.

❓ framework

expert

Best practice for securely handling Bearer tokens in automated tests

Which approach is the most secure and maintainable way to handle Bearer tokens in automated API tests using Postman?

A Store the Bearer token in an environment variable and reference it in the Authorization header.

B Generate a new Bearer token manually before each test run and paste it into the headers.

C Include the Bearer token in the request body as plain text for easier access.

D Hardcode the Bearer token directly in each request's Authorization header.

💡 Hint

Think about reusability and security of sensitive data in tests.

Storing the Bearer token in an environment variable allows easy updates and keeps sensitive data out of request bodies or hardcoded headers.