API TestingAPIAdvanced

Token refresh API

Scenario

Your interview prompt

A `POST /auth/refresh` endpoint exchanges a refresh token for a new access token and rotated refresh token. Reused refresh tokens should be detected, sessions can be revoked, and expired tokens must fail safely.

What would you test?

List flows, risks, edge cases, data conditions, UX, security, API/backend, and performance concerns.

Tip: a stronger answer usually mixes happy path, negative cases, state changes, data, backend, UX, accessibility, and risk.

How to structure your answer

Happy pathNegative casesData rulesSecurity/API risksUX/performance