Test Auth Flows

Now that you have implemented your authentication endpoints (login, callback, and logout), let's test some basic authentication flows to verify that everything is working correctly.

Test 1: Verify Signup Flow

First, test the Application-Level Signup flow by following these steps.

1. Select your application from the Dashboard Home Page.

2. Expand the Application URLs accordion on the settings page. Click the external link icon next to the Application-level Signup URL field.

3. The link opens the Application-Level Signup page in a new browser tab. Fill out the form and submit it to create your new tenant.

   1. Tenant Name — the name of the tenant that application-level signup creates under your application.
   2. Email — a valid email address you have access to. You'll need to view an activation email sent here to complete signup.
   3. Password — the password you'll use to log in.
   4. Click Sign Up.

4. Check your inbox for a verification email containing a one-time code. Enter this code into the form to complete your signup.

5. When the signup process succeeds, you are automatically redirected to your application's home page. This matches the default return URL you previously configured in your Callback Endpoints logic.

   Congratulations, you successfully completed the Application-Level Signup flow! Here is a summary of the operations performed behind the scenes during this process.

   Automated Background Operations

• Tenant creation: A new tenant was generated under your application using your input name.
• User creation: A new user profile was built under that tenant with your credentials.
• Account activation: The user account was verified and activated via the email code.
• Session initiation: A secure Wristband authentication session was established for the user.

Test 2: Verify Login Flow

Test the user login flow next. You must first clear any active sessions so you do not bypass the login screen.

Pre-Test Checklist

• Log out: Click the logout button in your application.
• Clear storage: Delete your browser cookies and local storage.
• Incognito mode: Alternatively, open a new private browsing window.

Clearing the User's Active Auth Sessions

Clear your user's active authentication sessions by following these setup steps.

1. Go to the Dashboard Home Page.

2. Locate and open the user profile you created during the signup test.

   Step-by-Step Instructions

   1. Click Users in the navigation bar.
   2. Find the user in the Users table.
   3. Click the user's row to open their profile.

3. Remove the active session directly from the user's profile settings.

   Step-by-Step Instructions

   1. Scroll down to the Active Auth Sessions section.
   2. Click the Delete Sessions button.

Perform User Login

Now that you have cleared the active sessions, start the user login flow test by accessing your app configuration.

Step-by-Step Instructions

1. Step 1: Open Your App
   1. Go to the Dashboard Home Page.
   2. Click your specific application name.

2. Expand the Application URLs accordion menu on the settings page. Click the external link icon next to the Application-level Login URL field.

   Step-by-Step Instructions

   1. Scroll down to Application URLs.
   2. Click the section header to expand.
   3. Find the Application-level Login URL field.
   4. Click the external link icon next to it.

3. The link opens the Application-Level Login page in a new browser tab. Select your previously created tenant to proceed to the login form.

   Step-by-Step Instructions

   1. Look at the listed tenants you previously authenticated with.
   2. Find the tenant you created during the signup flow.
   3. Click the Select button next to that tenant.

4. You should now see the login page for the selected tenant. Enter your credentials to log in.

   Step-by-Step Instructions

   1. Enter the email used during signup.
   2. Enter your password.
   3. Click the Log In button.

5. If login succeeds, you're redirected to the URL specified as the final redirect in your Callback Endpoint (set up in the Add Auth Endpoints step) — typically your application's home page.

Test 3: Verify Auth Session

1. Revisiting the login page with an active session will bypass the credential prompt and log you in automatically. Follow these steps to verify this behavior.

   Step-by-Step Instructions

   Step 1: Open the Login Page

   1. Enter your Application-Level Login URL into your browser.
   2. Note: If needed, find this URL on the Application Settings page under the Application URLs section.

2. Select your previously used tenant to trigger the session detection check.

   Step-by-Step Instructions

   1. Look at the listed tenants on the page.
   2. Find the tenant you logged into during the previous test.
   3. Click the Select button next to it.
   4. Wait for the page to redirect you to that tenant's specific login page.

3. Because your user has an active session, Wristband will skip the credential prompts entirely. You will be logged in immediately and sent back to your application's home page.

   Expected Behavior

   • Bypass credentials: The username and password form fields will not appear.
   • Automatic redirection: The browser automatically processes the session data.
   • Home page landing: You will land directly on your default callback destination.

Test 4: Verify Logout

1. To terminate your user's session, navigate directly to your local application logout route. This triggers the required cleanup logic and redirects you safely to the login screen.
2. Step-by-Step Instructions
   1. Type your Logout Endpoint URL into the browser address bar (e.g., http://localhost:8080/auth/logout).
   2. Press Enter to execute the logout route code.
   3. Confirm that you are automatically redirected to your tenant's login page.

3. Seeing the credential prompts on the tenant login page confirms your session has been terminated. This indicates that your logout flow successfully cleared all local and server-side authentication states.

   Success CriteriaForm

   • Form visible: The email and password inputs appear on the screen again.
   • Session cleared: No automated redirects bypass this screen.
   • State validated: The workflow successfully restored an unauthenticated state.

If you've reached this point, congratulations! Your Login Endpoint is working correctly.