API TestingAPIIntermediate

Login/auth API

Scenario

Your interview prompt

A `POST /auth/login` endpoint accepts email and password and returns access and refresh tokens. It supports locked accounts, disabled accounts, MFA-required users, and rate limiting after repeated failures.

What would you test?

List flows, risks, edge cases, data conditions, UX, security, API/backend, and performance concerns.

Tip: a stronger answer usually mixes happy path, negative cases, state changes, data, backend, UX, accessibility, and risk.

How to structure your answer

Happy pathNegative casesData rulesSecurity/API risksUX/performance