DummyJSON API Tests — Postman

A small API testing project demonstrating authentication flow testing using Postman: login, protected-resource access, negative (unauthenticated) access, and token refresh.

API under test

DummyJSON — a public mock REST API with a real JWT-based auth flow (access token + refresh token).

Why this project

Built to practice and demonstrate core API testing skills relevant to systems with token-based authentication, including:

• Verifying successful and failed auth states
• Checking that protected endpoints correctly reject missing credentials
• Testing session continuation via refresh tokens
• Using environment variables to avoid hardcoding secrets/tokens in requests

Scope

Request	Method	Endpoint	Scenario	Expected result
Login - success	POST	/auth/login	Valid credentials	200, returns accessToken + refreshToken
GET current user - authorized	GET	/auth/me	Valid Bearer token	200, returns correct user profile
GET current user - no token	GET	/auth/me	No credentials sent	401, "Access Token is required"
Refresh token - success	POST	/auth/refresh	Valid refresh token	200, returns new accessToken + refreshToken

Setup

1. Import the collection (postman/collections/DummyJSON API Tests) and environment (postman/environments/DummyJSON - Dev.environment.yaml) into Postman
2. Select the DummyJSON - Dev environment
3. Run Login - success first — it saves accessToken and refreshToken into the environment for use by the other requests
4. Run the remaining requests in any order

Notes

• Tokens are stored as Postman secret environment variables and are never committed with real values.
• /auth/me was found to also accept authentication via cookies set during login, in addition to the Bearer header. It is worth noting for anyone assuming header-only auth enforcement.