route-tester

To test API routes protected with cookie-based JWT authentication, use a script that fetches a refresh token, signs it, and applies a cookie header to automated requests against your endpoints.

Yes, you can test authenticated API routes without Keycloak by using an optional mock authentication workflow that generates tokens and provides example curl commands for local development.

You can generate curl commands to manually reproduce authenticated API tests by running an automated script that signs tokens and prints curl-ready commands with the correct cookie headers attached.

Automating Node.js API testing with refresh tokens is best handled by a reusable script that fetches the token, signs it, and makes authenticated POST requests with the appropriate cookie header.

Your protected route test fails when sending a JWT in the header because cookie-based JWT authentication requires the token in a cookie header rather than a standard authorization header.