route-tester

You can test authenticated API routes using an automated script that handles cookie-based JWT authentication, retrieves tokens from Keycloak, constructs cookie headers, and generates reproducible curl requests for validation.

Automating Keycloak token retrieval is handled by the test-auth-route.js script, which obtains refresh tokens, signs JWTs, and constructs cookie headers to build authenticated HTTP requests against your target URL.

Yes, you can reproduce authenticated curl requests manually by running the test-auth-route.js script against a target URL, which generates the exact authenticated request with constructed cookie headers for manual curl reproduction.

Yes, mock authentication is supported as a development-only testing method, providing an alternative to Keycloak integration for validating protected endpoints and route prefixes without requiring a live authentication server.

The best way to validate route protection across services is using automated auth tests that handle token retrieval, JWT signing, and cookie construction, supporting GET, POST, and workflow start scenarios with environment configurations.

Authenticated route tests fail with missing cookie headers when token retrieval or JWT signing is incomplete; using an automated test script ensures proper cookie construction and reproducible HTTP requests for protected endpoints.