dmitryprg-ai API Testing
Test API endpoints that require authorization.
Configuration: .cursor/config/project.config.json
Why Two Auth Levels
The API uses layered security: nginx handles Basic Auth for all requests (keeping the site private), while the application handles Session Auth for user-specific data. Health endpoint is exempt from session auth so monitoring tools can check availability without logging in.
| Level | Scope | Source |
|---|---|---|
| Basic Auth | All requests (nginx layer) | Config: auth.basic_auth_file |
| Session Auth | API endpoints except /health | Login via /api/auth/login |
Quick Start
# Get a session
bash ${CLAUDE_SKILL_DIR}/scripts/get-session.sh
# Test any endpoint
bash ${CLAUDE_SKILL_DIR}/scripts/test-endpoint.sh /api/endpoint?param=value
Manual Process
# 1. Read config
CONFIG=".cursor/config/project.config.json"
SITE_URL=$(jq -r .site_url "$CONFIG")
SECRETS_DIR=$(jq -r .auth.secrets_dir "$CONFIG")
TEST_EMAIL=$(jq -r .auth.test_user_email "$CONFIG")
# 2. Get Basic Auth
BASIC_AUTH=$(jq -r '.user + ":" + .pass' "$SECRETS_DIR/$(jq -r .auth.basic_auth_file "$CONFIG")")
# 3. Login to get session
PASSWORD=$(jq -r .password "$SECRETS_DIR/$(jq -r .auth.test_user_file "$CONFIG")" | base64 -d)
curl -c /tmp/session.txt -u "$BASIC_AUTH" \
-H "Content-Type: application/json" \
-d '{"email":"'"$TEST_EMAIL"'","password":"'"$PASSWORD"'"}' \
"$SITE_URL/api/auth/login"
# 4. Use session for requests
curl -b /tmp/session.txt -u "$BASIC_AUTH" "$SITE_URL/api/endpoint"
Important
- Never hardcode passwords in scripts or output — they change and leak
- Clean up after testing:
rm /tmp/session.txt - Test user has admin access to all endpoints
- Health endpoint only needs Basic Auth (no session required)