Testing OAuth 2.0, JWTs and token expiry

Most auth testing stops at "a valid token works, an invalid one does not", which leaves the interesting half untested: the token that was valid when the request started and expired before it finished. The APIs below issue genuinely signed, genuinely short-lived tokens, so refresh and expiry are things that actually happen.

How to practise it

1. Complete the client-credentials flow and call a protected endpoint with the token you were issued.
2. Wait for a short-lived token to expire and confirm your client refreshes transparently instead of failing the user's request.
3. Exchange a refresh token, then attempt to reuse the old one and read the rejection.
4. Run the authorization-code flow with PKCE, then retry with the wrong code_verifier.
5. Drive the device-code flow end to end — the one that matters for CLIs and TVs, and the one nobody tests.
6. Send a well-formed but wrongly-signed JWT and confirm it is refused as firmly as a missing one.

APIs to try it on

• Auth Playground API — OAuth 2.0 flows — client credentials, auth code, refresh & expiry. (6 endpoints)
• Webhooks API — Register callbacks, trigger events, inspect & replay deliveries. (7 endpoints)
• Modern Identity API — OIDC discovery, PKCE, device codes & token lifecycle. (6 endpoints)

Status codes involved

• 200 OK
• 400 Bad Request
• 401 Unauthorized
• 403 Forbidden

Other techniques

• Pagination testing — Practise page-number and cursor pagination, and the edge cases that break clients: the last partial page, an out-of-range page, and a total count that disagrees with what you collected.
• Rate limit testing — Trigger a real 429 with Retry-After and X-RateLimit headers, and verify your client backs off instead of retrying straight into the limit.
• Idempotency key testing — Send the same write twice with an Idempotency-Key and confirm the operation happens once — the mechanism that stops a network retry becoming a duplicate charge.
• ETag and If-Match testing — Provoke a 412 Precondition Failed by writing with a stale ETag — the check that stops two clients silently overwriting each other.
• Webhook signature testing — Register a callback, trigger a delivery, verify its HMAC signature, and confirm a tampered payload is rejected.
• Negative testing — Provoke 400, 401, 403, 404, 409, 418, 422, 429, 500 and 503 deliberately, and check your client handles each one differently.
• Async job testing — Start a long-running job, follow the 202 and its Location header, and poll to completion — including the failure and timeout paths.

Getting started guide · All 39 mock REST APIs

Last updated 6 September 2026