Authentication simulation
Simulate API Authentication Locally
Protect local mock endpoints with stateful bearer tokens, an API key, or HTTP Basic authentication. Authentication settings run inside the local mock server so frontend login, unauthorized, and logout flows can be exercised without a real backend.
Choose an authentication mode
Enable authentication for the project and select bearer token, API key, or Basic auth. Configure the unauthorized status and message that the frontend expects.
- Bearer mode supports local register, login, optional logout, token expiry, and revoked tokens.
- API-key mode reads a configurable header or query parameter.
- Basic mode validates the configured username and password.
Use bearer-token routes
Bearer mode exposes configurable public auth routes. Registration stores a locally hashed password and mock user profile. Login can validate credentials or create/find mock users when validation is disabled.
POST /auth/login
content-type: application/json
{ "email": "dev@example.com", "password": "local-password" }
GET /products
authorization: Bearer <local-token>Use an API key or Basic auth
For API keys, require either a specific value or simple presence. For Basic auth, configure local-only credentials and send the standard Authorization header. Never reuse production credentials in a mock project.
curl -H "x-api-key: local-demo-key" http://localhost:4000/products
curl -u demo:local-password http://localhost:4000/productsTest success and failure states
Call the same route with valid, missing, expired, revoked, and incorrect credentials. These repeatable states help verify route guards and session-expiry UI; they do not replace security testing of the production backend.
Related questions
Does authentication simulation include roles and permissions?
No. Current simulation covers authentication, not resource-level authorization policies or user roles.
Keep exploring
Last updated September 17, 2026. Product behavior described here is verified against the current Mock API Studio runtime.