API Auth Realtime

API Auth Realtime

Beyond the page: contracts, sessions, streams, Core Web Vitals. Deep: Tutorial 12.

API contract tests

zyvor-qa api-test https://api.example.com --spec https://api.example.com/openapi.json
zyvor-qa api-test https://api.example.com --spec ./openapi.yaml --workflow ./workflow.json

Validates REST endpoints against OpenAPI; --workflow for multi-step API flows.

Auth & session

zyvor-qa auth-test https://app.example.com --api-login /api/login

Log in, save reusable session, assert logout / expiry / negative auth.

Configure ZYVOR_TEST_USER / ZYVOR_TEST_PASSWORD and ENABLE_DASHBOARD_TESTS=true when the target has a real login (marketing zyvor.dev skips login-tagged tests by default).

Realtime (WebSocket / SSE)

zyvor-qa realtime https://app.example.com --ws /ws/events

Assert stream is live; optional reconnect / live-view checks.

Core Web Vitals

zyvor-qa vitals https://zyvor.dev

LCP / CLS / INP with device + network throttle options (also Mission Control Vitals card).

Pipeline flag

ENABLE_API_VALIDATION=true validates HTTP statuses from fixtures/HAR during zyvor-qa run.

Related: Probes and Audits · CLI Commands.