Authentication documentation in Rest API - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to specify the authentication type in the API documentation.

Rest API

securitySchemes:
  ApiKeyAuth:
    type: [1]
    in: header
    name: X-API-KEY

Drag options to blanks, or click blank then click option'

Ahttp

Boauth2

CopenIdConnect

DapiKey

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'http' or 'oauth2' instead of 'apiKey' for API key authentication.

The type for API key authentication in OpenAPI is apiKey.

2fill in blank

medium

Complete the code to define the OAuth2 flow type in the authentication documentation.

Rest API

securitySchemes:
  OAuth2Auth:
    type: oauth2
    flows:
      [1]:
        authorizationUrl: https://example.com/auth
        tokenUrl: https://example.com/token
        scopes:
          read: Grants read access

Drag options to blanks, or click blank then click option'

AclientCredentials

BauthorizationCode

Cpassword

Dimplicit

Attempts:

3 left

💡 Hint

Common Mistakes

Confusing 'clientCredentials' or 'password' flows with 'authorizationCode'.

The authorizationCode flow is used for OAuth2 where the client gets an authorization code first.

3fill in blank

hard

Fix the error in the HTTP authentication scheme name.

Rest API

securitySchemes:
  BasicAuth:
    type: http
    scheme: [1]

Drag options to blanks, or click blank then click option'

Abasic

Bdigest

Cbearer

Doauth

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'bearer' or 'oauth' instead of 'basic' for Basic Auth.

The scheme for HTTP Basic Authentication is basic.

4fill in blank

hard

Fill both blanks to define a Bearer token authentication scheme with the correct type and scheme.

Rest API

securitySchemes:
  BearerAuth:
    type: [1]
    scheme: [2]

Drag options to blanks, or click blank then click option'

Ahttp

BapiKey

Cbearer

Doauth2

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'apiKey' as type for Bearer tokens.

Confusing 'oauth2' with Bearer scheme.

Bearer token authentication uses type: http and scheme: bearer.

5fill in blank

hard

Fill all three blanks to define an OAuth2 implicit flow with the correct type, flow, and authorization URL.

Rest API

securitySchemes:
  OAuth2Implicit:
    type: [1]
    flows:
      [2]:
        authorizationUrl: [3]
        scopes:
          write: Grants write access

Drag options to blanks, or click blank then click option'

Aoauth2

Bimplicit

Chttps://example.com/oauth/authorize

DauthorizationCode

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'authorizationCode' flow instead of 'implicit'.

Wrong authorization URL format.

OAuth2 implicit flow uses type: oauth2, flow: implicit, and the authorization URL points to the OAuth2 authorization endpoint.

Practice

1. What is the main purpose of authentication in a REST API?

easy

A. To speed up the API response time

B. To encrypt the data sent over the network

C. To format the API response in JSON

D. To confirm the identity of a user or client

Solution

1. Step 1: Understand authentication role

   Authentication is about confirming who the user or client is.

2. Step 2: Differentiate from other API functions

   Encryption, speed, and formatting are different concerns, not authentication.

3. Final Answer:

   To confirm the identity of a user or client -> Option D

4. Quick Check:

   Authentication = Confirm identity [OK]

Hint: Authentication means confirming who you are [OK]

Common Mistakes:

• Confusing authentication with encryption
• Thinking authentication speeds up API
• Mixing authentication with data formatting

2. Which of the following is the correct way to send an authentication token in a REST API request header?

easy

A. Token: <token>

B. Auth-Token: <token>

C. Authorization: Bearer <token>

D. Access: <token>

Solution

1. Step 1: Recall standard header format

   The standard way to send tokens is using the 'Authorization' header with 'Bearer' prefix.

2. Step 2: Compare options

   Only Authorization: Bearer <token> uses the correct 'Authorization: Bearer <token>' format.

3. Final Answer:

   Authorization: Bearer <token> -> Option C

4. Quick Check:

   Token header = Authorization: Bearer [OK]

Hint: Use 'Authorization: Bearer' to send tokens [OK]

Common Mistakes:

• Using wrong header names like 'Token' or 'Access'
• Omitting 'Bearer' keyword before token
• Placing token in URL instead of header

3. Given this API request code snippet, what will be the output if the token is missing?

fetch('https://api.example.com/data', {
  headers: { 'Authorization': 'Bearer ' }
})
.then(response => response.status)
.then(status => console.log(status));

medium

A. 401

B. 404

C. 500

D. 200

Solution

1. Step 1: Understand missing token effect

   When the token is missing or empty, the server usually rejects the request as unauthorized.

2. Step 2: Identify HTTP status code for unauthorized

   The standard status code for unauthorized access is 401.

3. Final Answer:

   401 -> Option A

4. Quick Check:

   Missing token = 401 Unauthorized [OK]

Hint: Missing token causes 401 Unauthorized error [OK]

Common Mistakes:

• Assuming missing token returns 200 OK
• Confusing 401 with 404 Not Found
• Thinking server returns 500 error

4. Identify the error in this authentication header usage:

headers: {
  'Authorization': 'BearerToken abc123'
}

medium

A. Missing space between 'Bearer' and token

B. Token should be in lowercase

C. Authorization header should be 'Auth' instead

D. Token must be sent as a query parameter

Solution

1. Step 1: Check Authorization header format

   The correct format requires a space between 'Bearer' and the token string.

2. Step 2: Verify the given header

   The header uses 'BearerToken' without space, which is incorrect.

3. Final Answer:

   Missing space between 'Bearer' and token -> Option A

4. Quick Check:

   Bearer and token need space [OK]

Hint: Add space after 'Bearer' before token [OK]

Common Mistakes:

• Writing 'BearerToken' as one word
• Using wrong header name like 'Auth'
• Sending token in URL instead of header

5. You want to secure an API endpoint so only authenticated users can access it. Which combination is best practice for this in your API documentation?

hard

A. Allow clients to send username and password in every request body

B. Require clients to send a valid token in the 'Authorization: Bearer <token>' header for access

C. Use IP address filtering to allow only certain clients

D. Send the token as a URL parameter for easy access

Solution

1. Step 1: Identify secure token usage

   Best practice is to require a valid token in the 'Authorization' header to confirm identity securely.

2. Step 2: Evaluate other options

   Sending username/password every time is insecure; IP filtering is limited; URL tokens risk exposure.

3. Final Answer:

   Require clients to send a valid token in the 'Authorization: Bearer <token>' header for access -> Option B

4. Quick Check:

   Token in Authorization header = secure access [OK]

Hint: Use Authorization header with token, not URL or body [OK]

Common Mistakes:

• Sending credentials in every request body
• Exposing tokens in URL parameters
• Relying only on IP filtering for security