Prove your bearer token check works

You have an API token in your hand, but you've never proven that the API rejects a call without it and accepts one with it.

Beginner to intermediateRead 5 minDoing: about twenty minutes6 steps

▶ Start

What you'll have at the end

Two curl calls against a real service: one without a token that gets rejected, one with a valid token that gets through

Before you start

You need

A running API with a route that's supposed to require a bearer token, one token you know is genuinely valid for it, and curl or an equivalent HTTP client at the command line.

Not covered

How to build the bearer-token check itself, or how to generate and validate a JWT; this only covers proving a check that already exists behaves the way you think it does.

Leans on

6 steps

Where to go next

Audit a login cookie for its missing security flags

when the credential riding along is a session cookie instead of a bearer token

Checked 18 Aug 2026

Part of the HTTP cookbook