Summary

This chapter has covered a lot of territory. Security is a complex and important topic and understanding how to work with it is an important part of API testing. In this chapter, I have shown you how to think about API security and what the distinction is between authorization and authentication in security. I also showed you how to use the various Postman authorization types to give you access to secured APIs. You learned how to log in with many different authorization types ranging from Basic Auth to API keys and tokens to OAuth 2.0. I also showed you some of the other authorization options in Postman and showed you how to get started with them.

We didn't just look at how to call secured APIs in this chapter though. I also helped you get started with a few security testing techniques such as fuzzing, command injection, and authorization testing and showed you how to use them in Postman. In addition, you learned how to integrate Postman with other external security...