Back to challenges
API TestingAPIAdvanced
Auth token refresh API
?
Scenario
Your interview prompt
POST /auth/refresh accepts a refresh token and returns a new access token plus a rotated refresh token. Access tokens expire after 15 minutes, refresh tokens expire after 30 days, and reused or revoked refresh tokens should terminate the session.
List flows, risks, edge cases, data conditions, UX, security, API/backend, and performance concerns.
Tip: a stronger answer usually mixes happy path, negative cases, state changes, data, backend, UX, accessibility, and risk.
How to structure your answer
Happy pathNegative casesData rulesSecurity/API risksUX/performance