Authentication

Introduction

Authentication is a practical Playwright skill for testers who want faster, less brittle suites by combining API and UI checks. Instead of memorizing syntax, learn the production reason behind it: what risk it reduces, what evidence it gives, and how it changes the way a team ships software.

Purpose of this lesson

Story: A login workflow test dropped from 70 seconds to 9 seconds when setup moved from UI clicks to API calls. In this lesson, authentication covers tokens, cookies, sessions, and protected endpoints. That is the difference between a test that merely runs and a test that helps a team decide.

Understanding the topic

Why this exists: Authentication covers tokens, cookies, sessions, and protected endpoints. API testing in Playwright is not a separate world. It prepares data, validates contracts, and shortens UI flows.

• Real problem solved: Authentication reduces ambiguity when browser behavior, data, timing, or infrastructure changes.
• Production use: test data setup, cleanup, contract checks, auth flows, chained workflows, and backend validation.
• Beginner misuse: Using UI for every setup step, making tests slow and fragile.
• Elite SDET move: Use APIs to create state, then use UI to prove the user-facing journey.

Visual explanation

Mental model:

API setup
  ↓
UI action
  ↓
API verification
  ↓
Cleanup

Informative example

A practical example for Authentication:

const created = await request.post("/api/orders", {
  data: { sku: "authentication", quantity: 1 },
});
expect(created.ok()).toBeTruthy();
await page.goto(`/orders/${(await created.json()).id}`);
await expect(page.getByText("authentication")).toBeVisible();

Execution workflow

Real-world use

In real teams, Authentication matters because product code changes every week. The test must still tell a useful story: what user behavior was protected, what state was expected, what evidence was captured, and whether the failure belongs to the app, the test, the data, or the environment.

Best practices

• Create expensive state through API when UI setup is not the thing under test.
• Validate status, schema, and business fields.
• Keep API helpers typed.
• Clean up data through API when possible.

Common mistakes

• Turning an end-to-end test into an API-only test accidentally.
• Ignoring contract validation and checking only status 200.
• Leaving test data behind after failures.

Debugging tips

• Attach request and response payloads on API failure.
• Check auth headers and environment baseURL first.
• If UI and API disagree, verify caching and eventual consistency.

Advanced interview questions

Summary

Authentication is valuable when it makes browser automation faster, clearer, and easier to debug under real product change.