route-tester

Automate testing of protected API routes with cookie-based JWT authentication.

Updated Dec 5, 2025
One-click install
npx skills add https://github.com/NmBoyd/claude_setup --skill route-tester-nmboyd
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: route-tester
Source: https://github.com/NmBoyd/claude_setup/tree/main/.claude/skills/route-tester
Command: npx skills add https://github.com/NmBoyd/claude_setup --skill route-tester-nmboyd

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill provides a structured approach to testing authenticated routes by automating cookie-based JWT authentication for API endpoints, reducing manual setup and debugging time.

Core Features & Use Cases

  • Automated retrieval of refresh tokens from Keycloak, signing with a local JWT secret, and sending authenticated requests.
  • Supports GET, POST, and other HTTP methods across multiple services for protected routes.
  • Useful for development, testing, and debugging authentication flows, including workflow start and step completion checks.

Quick Start

Run test-auth-route.js against a target URL with the desired HTTP method and data to perform an authenticated request.

Frequently Asked Questions about route-tester

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test API routes protected with cookie-based JWT authentication?

To test API routes protected with cookie-based JWT authentication, you can automate token retrieval, sign it with a local secret, construct the cookie header, and execute authenticated GET or POST requests against protected endpoints.

How do I automate Keycloak token retrieval for testing protected API endpoints?

Automating Keycloak token retrieval involves fetching refresh tokens from the Keycloak server, signing them locally with a configured JWT secret, and injecting the resulting token into cookie headers for authenticated API route testing.

Can I use mock authentication to test protected routes without a live Keycloak server?

Yes, you can use optional mock authentication to validate GET and POST flows against protected resources without relying on a live Keycloak server, allowing you to test authenticated routes locally.

What is the best way to debug authenticated API requests using cookie headers?

The best way to debug authenticated API requests using cookie headers is to execute the requests with verbose output, allowing you to reproduce and inspect the token signing, cookie construction, and request execution steps.

Does this approach support testing both GET and POST flows for protected resources?

Yes, this approach supports testing both GET and POST HTTP methods across multiple backend services to validate protected resources and debug authentication workflows like workflow start and step completion checks.

Why are my authenticated route tests failing when using cookie-based JWT tokens?

Authenticated route tests using cookie-based JWT tokens often fail due to incorrect token signing with the configured secret or malformed cookie headers, which can be identified by examining the verbose output of the request execution.