skills.rest
Boulea7
Boulea7COMMUNITY
Explore all skills by this author →
GitHub

route-tester

Test authenticated API routes using cookie-based JWT authentication and mock auth headers.

Updated Dec 1, 2025
Search Tags:#authentication#jwt#api testing#curl#keycloak#route debugging#mock auth
One-click install
npx skills add https://github.com/Boulea7/ohmyclaude --skill route-tester-boulea7
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: route-tester
Source: https://github.com/Boulea7/ohmyclaude/tree/main/src/ohmyclaude/templates/skills/route-tester
Command: npx skills add https://github.com/Boulea7/ohmyclaude --skill route-tester-boulea7

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Testing authenticated API endpoints requires juggling Keycloak tokens, JWT signing, and cookie headers manually, which slows down route validation and debugging of 401/403/404 errors. ## Core Features & Use Cases - Automated Auth Testing: Use the test-auth-route.js script to obtain Keycloak tokens, sign JWTs, and send cookie-authenticated GET/POST requests in one command. - Mock Authentication: Bypass Keycloak in development by sending X-Mock-Auth headers when MOCK_AUTH is enabled in the service .env file. - Failure Diagnosis: Follow structured checklists for debugging 401, 403, 404, and 500 responses, including token regeneration, route prefix verification, and log inspection. - Use Case: After adding a new POST endpoint to the form service, run test-auth-route.js with the full URL and JSON body, then verify the resulting database rows in MySQL. ## Quick Start Test the route http://localhost:3002/api/workflow/start with a POST body containing a workflowCode using the authenticated route testing pattern.

Frequently Asked Questions about route-tester

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test an authenticated API route with curl?▼

Run test-auth-route.js with the target URL to get a signed JWT, then copy the printed curl command using the refresh_token cookie. For POST requests, add -H "Content-Type: application/json" and a -d JSON body.

How to bypass Keycloak authentication in local development?▼

Set MOCK_AUTH=true in the service .env file and send X-Mock-Auth, X-Mock-User, and X-Mock-Roles headers with your request. Mock auth only works when NODE_ENV is development or test and never works in production.

Why does my API request return 401 Unauthorized?▼

A 401 usually means the token expired, the cookie format is wrong, the JWT secret mismatches config.ini, or Keycloak is not running. Regenerate the token with test-auth-route.js and confirm Keycloak is up with docker ps.

Why do I get 404 Not Found on a route that exists?▼

A 404 typically means the URL is missing the route prefix defined in the service's app.ts, or the service is not running. Check app.ts for prefixes like /blog-api/api and verify the service with pm2 list.

Can mock authentication be used in production?▼

No, mock auth is disabled outside development and test environments as a security feature. Production requests must use real Keycloak-issued tokens passed via the refresh_token cookie.

Related Skills

Explore More Software Engineering Skills→
FlexNetOSFlexNetOS

Identity & Authentication

Configure Keycloak realms, OPA policies, and Vault secrets for authentication.

Community
Advanced
coil398coil398
8

tester

Execute tests and ad-hoc checks to return a PASS/FAIL verdict.

Community
Intermediate
gengirishgengirish

pino-otel-sentry

Implements Pino logging, OpenTelemetry tracing, and Sentry error tracking for Node.js services.

Community
Intermediate
aibangjuxinaibangjuxin
2

api-tester

Test RESTful APIs with manual and automated scripts.

Community
Intermediate