Scenario
Auth Token Lifecycle
Pure API: get a short-lived access token (20s) and a refresh token, hit a protected endpoint until it expires, refresh to get a new pair (rotating out the old refresh token), or revoke it outright. No cookies, no browser session — just bearer tokens.
How this works
- · Pure bearer-token auth, no cookies — POST /token with standard_user's credentials returns a short-lived access token (20s) and a longer-lived refresh token (5min), both HMAC-signed and verified statelessly server-side.
- · The access token expires fast on purpose so you can practice a 401-then-refresh flow without waiting minutes — hit /protected repeatedly and watch it flip to 401 right around the 20-second mark.
- · Refreshing rotates the refresh token too — the old one stops working, the pattern real APIs use to limit how long a leaked refresh token stays useful. Revoking a token adds it to an in-memory revocation set, invalidating it immediately.
What you'll practice
- An access token that genuinely expires in 20 seconds — no waiting hours to test expiry
- A protected endpoint returning distinct error codes (missing_token, invalid_token, expired_token, revoked_token) instead of one generic 401
- Refreshing rotates BOTH tokens — the old refresh token stops working the instant a new one is issued
- Explicit revocation ("log out everywhere") — a refresh token that still has time left but was manually revoked
API reference
POST /api/scenarios/api-auth/token
body { username, password } → { accessToken, refreshToken, expiresIn }
GET /api/scenarios/api-auth/protected
header Authorization: Bearer <accessToken> → 200 or 401 with a specific error code
POST /api/scenarios/api-auth/refresh
body { refreshToken } → a brand new access + refresh token pair (old refresh token revoked)
POST /api/scenarios/api-auth/revoke
body { refreshToken } → invalidates it immediately, before its natural expiry
curl -X POST https://playground.krishanchawla.com/api/scenarios/api-auth/token -H "Content-Type: application/json" -d '{"username":"standard_user","password":"Password123!"}'
curl https://playground.krishanchawla.com/api/scenarios/api-auth/protected -H "Authorization: Bearer <accessToken>"
curl -X POST https://playground.krishanchawla.com/api/scenarios/api-auth/refresh -H "Content-Type: application/json" -d '{"refreshToken":"<refreshToken>"}'
- 1 Console