</>

Technology

Rest Assured

Difficulty

Intermediate

Experience

1-2 Years

Type

Technical

AutomateQA Team

QA Automation Engineers

June 19, 2026

Interview Question

What is JWT (JSON Web Token) and how do you use it in API testing?

Q: What is JWT (JSON Web Token) and how do you use it in API testing?

JWT — JSON Web Token JWT (JSON Web Token) is a compact, self-contained token used to securely transmit information between parties as a JSON object. It is the most common authentication mechanism for modern REST APIs. JWT Structure A JWT has 3 parts separated by dots: header.payload.signature eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ1c2VyMSIsImlhdCI6MTcxODAwMDAwMCwiZXhwIjoxNzE4MDAzNjAwfQ.abc123 ↑ ↑ ↑ Header Payload Signature (algorithm) (userId, role, expiry time) (verifies authenticity) Decoded Payload: json { "sub": "user1", "role": "admin", "iat": 1718000000, "exp": 1718003600 } Step 1: Get JWT Toke

Answer

JWT — JSON Web Token

JWT (JSON Web Token) is a compact, self-contained token used to securely transmit information between parties as a JSON object. It is the most common authentication mechanism for modern REST APIs.

JWT Structure

▸A JWT has 3 parts separated by dots: header.payload.signature

CODE

eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ1c2VyMSIsImlhdCI6MTcxODAwMDAwMCwiZXhwIjoxNzE4MDAzNjAwfQ.abc123
        ↑                              ↑                                                    ↑
     Header                         Payload                                            Signature
  (algorithm)           (userId, role, expiry time)                            (verifies authenticity)

Decoded Payload:

JSON

{
  "sub": "user1",
  "role": "admin",
  "iat": 1718000000,
  "exp": 1718003600
}

Step 1: Get JWT Token via Login

Java

public class TokenManager {

    private static String token;

    public static String getToken() {
        if (token == null) {
            token = given()
                        .contentType(ContentType.JSON)
                        .body("{ \"username\": \"admin\", \"password\": \"admin123\" }")
                        .when()
                        .post("https://api.example.com/auth/login")
                        .then()
                        .statusCode(200)
                        .extract()
                        .path("access_token");
        }
        return token;
    }
}

Step 2: Use Token in API Requests

Java

@Test
public void testGetProtectedResource() {

    given()
        .header("Authorization", "Bearer " + TokenManager.getToken())
        .when()
        .get("/api/users/profile")
        .then()
        .statusCode(200)
        .body("role", equalTo("admin"));
}

Step 3: Test Token Expiry

Java

@Test
public void testExpiredTokenReturns401() {

    String expiredToken = "eyJhbGciOiJIUzI1NiJ9.eyJleHAiOjEwMDAwMH0.invalid";

    given()
        .header("Authorization", "Bearer " + expiredToken)
        .when()
        .get("/api/users")
        .then()
        .statusCode(401)
        .body("error", equalTo("Token expired"));
}

Step 4: Test Missing Token

Java

@Test
public void testMissingTokenReturns401() {
    given()
        .when()
        .get("/api/users")  // no Authorization header
        .then()
        .statusCode(401);
}

JWT vs Session Tokens

Feature	JWT	Session Token
Stateless	Yes	No (server stores session)
Self-contained	Yes (has user data)	No (just a reference ID)
Expiry	Encoded in token	Managed server-side
Scalable	Yes	Harder (sticky sessions)
Revocable	Hard (until expiry)	Easy