Why mock JWT authentication?
Building real authentication (database, password hashing, sessions, refresh tokens) takes days. When the goal is testing UI flows — login screen, redirects, session persistence, token expiry — a JWT mock lets you move forward without waiting for the backend.
Creating the login endpoint
// Mock Rule: POST /auth/login → 200
{
"access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
"token_type": "Bearer",
"expires_in": 86400
}
# Test the login mock
curl -X POST https://httpdrop.com/mock/YOUR_ENDPOINT_ID/auth/login -H "Content-Type: application/json" -d '{"email":"alice@example.com","password":"any"}' | jq .
Simulating invalid credentials
// Mock Rule: POST /auth/login → 401
{
"error": "invalid_credentials",
"message": "Invalid email or password"
}
Security: Mock JWTs must never be used in production. For testing, use HS256 with a test key like
"test-secret-key" — never expose production keys in browser tools or repositories.