Back to API Practice

Security/Auth trainer

API Key Management API Practice

Practice API key creation, one-time secret display, scopes, expiry, rotation, revocation, tenant permissions, leakage prevention, and auditability.

Start writing test ideasTry API sandbox

How to use this trainer

Choose, send, inspect, write, improve

Safe client-side simulator. No real backend is called and no real data is sent.

  1. 1Choose a preset case
  2. 2Send a simulated request
  3. 3Read the response and QA note
  4. 4Write what you would test
  5. 5Check your coverage

Interactive sandbox

Try the API request

Pick a preset, send a simulated POST /api/api-keys request, inspect the fake response, and turn it into test ideas.

No API keys or tokens are sent. The fake key values are local placeholders only.

Request

Build the request

POST/api/api-keys

Request JSON

application/json
{
  "name": "CI integration",
  "scopes": [
    "users:read"
  ],
  "expiresAt": "2026-12-31T23:59:59Z"
}

Test case presets

Choose a case, inspect the fake response, then write what you would test.

Happy path

Validation

Lifecycle

Auth / tenant

Reliability

Response

Fake API result

Send a simulated request to see status, response JSON, QA note, and what to notice. No real backend is called.

List create key, scopes, expiry, one-time secret, masked list, rotation, revocation, missing permission, tenant isolation, leaked key handling, safe logs, audits, and store failures.

Tip: a stronger answer usually mixes happy path, negative cases, state changes, data, backend, UX, accessibility, and risk.

How to structure your answer

Happy pathNegative casesData rulesSecurity/API risksUX/performance
API ReferenceEndpoint, request fields, responses, and business rulesExpand

API reference

API Key Management endpoint

Create, rotate, and revoke API keys with safe secret handling, scopes, tenant boundaries, and audit events.

Endpoint

POST/api/api-keys

Purpose

Create, rotate, and revoke API keys with safe secret handling, scopes, tenant boundaries, and audit events.

Request fields

  • name: string, required
  • scopes: string[], required
  • expiresAt: ISO datetime, optional
  • tenantId: derived from auth context

Success response

201 Created

Request body

{
  "name": "CI integration",
  "scopes": ["users:read"],
  "expiresAt": "2026-12-31T23:59:59Z"
}

Example response body

{
  "id": "key_123",
  "prefix": "wtt_live_abc",
  "secret": "wtt_live_abc...shown-once",
  "scopes": ["users:read"]
}

Errors

  • 400 validation error
  • 401 unauthorized
  • 403 forbidden scope
  • 409 duplicate key name
  • 429 rate limited
  • 503 key store unavailable

Security notes

  • Key secret is shown only once
  • Store hashed key material only
  • Do not log raw keys
  • Revoked keys must be rejected on protected APIs

Business rules

  • Create key requires permission
  • Scopes must be allowed for the caller
  • Rotation issues a new secret and handles old-key policy
  • Revocation is audited
  • Tenant isolation is enforced