Authentication documentation in Rest API - Mini Project: Build & Apply

Authentication Documentation for REST API

📖 Scenario: You are building a simple REST API that requires users to authenticate before accessing protected resources. You want to create clear documentation that explains how to authenticate using your API.

🎯 Goal: Create step-by-step authentication documentation that shows how to set up credentials, configure authentication headers, and test access to a protected endpoint.

📋 What You'll Learn

Create a data structure to hold example user credentials

Add a configuration variable for the authentication token

Write the core logic to simulate checking the authentication token

Output the result of the authentication check

💡 Why This Matters

🌍 Real World

APIs often require users to prove who they are before giving access to data or services. This project shows how to document and simulate that process.

💼 Career

Understanding authentication is key for backend developers, API designers, and security engineers to protect applications and user data.

1

DATA SETUP: Create example user credentials

Create a dictionary called user_credentials with these exact entries: 'username': 'testuser' and 'password': 'securepass123'.

Rest API

# Create a dictionary called user_credentials with username and password
# Your code here

Hint

Use curly braces to create a dictionary with keys 'username' and 'password'.

2

CONFIGURATION: Add an authentication token variable

Create a variable called auth_token and set it to the string 'abc123token'.

Rest API

user_credentials = {'username': 'testuser', 'password': 'securepass123'}
# Create a variable called auth_token with value 'abc123token'
# Your code here

Hint

Assign the string 'abc123token' to the variable auth_token.

3

CORE LOGIC: Simulate authentication check

Write an if statement that checks if auth_token equals 'abc123token'. If true, set a variable access_granted to True, else set it to False.

Rest API

user_credentials = {'username': 'testuser', 'password': 'securepass123'}
auth_token = 'abc123token'
# Check if auth_token equals 'abc123token' and set access_granted accordingly
# Your code here

Hint

Use an if-else statement to compare auth_token with the expected string.

4

OUTPUT: Display authentication result

Write a print statement that outputs 'Access granted' if access_granted is True, otherwise output 'Access denied'.

Rest API

user_credentials = {'username': 'testuser', 'password': 'securepass123'}
auth_token = 'abc123token'
if auth_token == 'abc123token':
    access_granted = True
else:
    access_granted = False
# Print 'Access granted' if access_granted is true, else print 'Access denied'
# Your code here

Hint

Use an if statement to print the correct message based on access_granted.

Practice

1. What is the main purpose of authentication in a REST API?

easy

A. To speed up the API response time

B. To encrypt the data sent over the network

C. To format the API response in JSON

D. To confirm the identity of a user or client

Solution

1. Step 1: Understand authentication role

   Authentication is about confirming who the user or client is.

2. Step 2: Differentiate from other API functions

   Encryption, speed, and formatting are different concerns, not authentication.

3. Final Answer:

   To confirm the identity of a user or client -> Option D

4. Quick Check:

   Authentication = Confirm identity [OK]

Hint: Authentication means confirming who you are [OK]

Common Mistakes:

• Confusing authentication with encryption
• Thinking authentication speeds up API
• Mixing authentication with data formatting

2. Which of the following is the correct way to send an authentication token in a REST API request header?

easy

A. Token: <token>

B. Auth-Token: <token>

C. Authorization: Bearer <token>

D. Access: <token>

Solution

1. Step 1: Recall standard header format

   The standard way to send tokens is using the 'Authorization' header with 'Bearer' prefix.

2. Step 2: Compare options

   Only Authorization: Bearer <token> uses the correct 'Authorization: Bearer <token>' format.

3. Final Answer:

   Authorization: Bearer <token> -> Option C

4. Quick Check:

   Token header = Authorization: Bearer [OK]

Hint: Use 'Authorization: Bearer' to send tokens [OK]

Common Mistakes:

• Using wrong header names like 'Token' or 'Access'
• Omitting 'Bearer' keyword before token
• Placing token in URL instead of header

3. Given this API request code snippet, what will be the output if the token is missing?

fetch('https://api.example.com/data', {
  headers: { 'Authorization': 'Bearer ' }
})
.then(response => response.status)
.then(status => console.log(status));

medium

A. 401

B. 404

C. 500

D. 200

Solution

1. Step 1: Understand missing token effect

   When the token is missing or empty, the server usually rejects the request as unauthorized.

2. Step 2: Identify HTTP status code for unauthorized

   The standard status code for unauthorized access is 401.

3. Final Answer:

   401 -> Option A

4. Quick Check:

   Missing token = 401 Unauthorized [OK]

Hint: Missing token causes 401 Unauthorized error [OK]

Common Mistakes:

• Assuming missing token returns 200 OK
• Confusing 401 with 404 Not Found
• Thinking server returns 500 error

4. Identify the error in this authentication header usage:

headers: {
  'Authorization': 'BearerToken abc123'
}

medium

A. Missing space between 'Bearer' and token

B. Token should be in lowercase

C. Authorization header should be 'Auth' instead

D. Token must be sent as a query parameter

Solution

1. Step 1: Check Authorization header format

   The correct format requires a space between 'Bearer' and the token string.

2. Step 2: Verify the given header

   The header uses 'BearerToken' without space, which is incorrect.

3. Final Answer:

   Missing space between 'Bearer' and token -> Option A

4. Quick Check:

   Bearer and token need space [OK]

Hint: Add space after 'Bearer' before token [OK]

Common Mistakes:

• Writing 'BearerToken' as one word
• Using wrong header name like 'Auth'
• Sending token in URL instead of header

5. You want to secure an API endpoint so only authenticated users can access it. Which combination is best practice for this in your API documentation?

hard

A. Allow clients to send username and password in every request body

B. Require clients to send a valid token in the 'Authorization: Bearer <token>' header for access

C. Use IP address filtering to allow only certain clients

D. Send the token as a URL parameter for easy access

Solution

1. Step 1: Identify secure token usage

   Best practice is to require a valid token in the 'Authorization' header to confirm identity securely.

2. Step 2: Evaluate other options

   Sending username/password every time is insecure; IP filtering is limited; URL tokens risk exposure.

3. Final Answer:

   Require clients to send a valid token in the 'Authorization: Bearer <token>' header for access -> Option B

4. Quick Check:

   Token in Authorization header = secure access [OK]

Hint: Use Authorization header with token, not URL or body [OK]

Common Mistakes:

• Sending credentials in every request body
• Exposing tokens in URL parameters
• Relying only on IP filtering for security