E2E testing

This article covers some helpful strategies when setting up end-to-end (E2E) tests on top of Stytch-powered authentication flows. You'll learn how to:

• Set up automated tests for different authentication products
• Generate Stytch session tokens or JWTs
• Avoid Stytch rate limits when testing

You may need to complete a passwordless authentication flow during some of your automated tests. In order to accomplish this, we generally recommend using a platform like Mailosaur to set up a programmatically accessible email or SMS inbox.

Two of our engineers discussed passwordless E2E testing at a recent Cypress conference:

You can find the repository that accompanies the above talk here.

We have a bot detection mechanism built into our Email Magic Links flow that prevents email security bots from following and invalidating your users' Magic Link tokens. For additional information, see our Protected Magic Links resource.

You may run into this bot protection when setting up automated Email Magic Links or Password reset by email tests. Below is a strategy that will allow your tests to proceed by bypassing the redirect to the Stytch-hosted page where bot detection runs:

Here's example code that demonstrates the above strategy:

function formatMagicLink(
  magicLinkFromEmail: string,
  loginRedirectUrl: string
): string {
  const queryParameters = new URL(magicLinkFromEmail).searchParams.toString();
  return `${loginRedirectUrl}?${queryParameters}`;
}

Sometimes, you'll need to generate a Stytch session token or JWT for use in E2E tests that aren't intended to test your login flow itself.

For this use case, a common strategy is to leverage passwords for testing purposes, even if you don't use our Passwords product as part of your production login flow:

1. Create a test Member in a test Organization, and add a password to the Member.
2. At the beginning of each test that requires a Stytch session token or JWT, call the Authenticate password endpoint with the test email_address and password values from the previous step.
3. Retrieve the session_token or session_jwt value from the Authenticate password response for use in the rest of your test.

We have rate limits built into our API in order to protect our endpoints from malicious traffic (see our Rate limits resource for additional information). You may run into certain rate limits depending on how frequently you run your E2E tests and which Stytch endpoints you're calling.

In order to avoid hitting Stytch rate limits, we recommend running your tests using your Stytch Test project keys whenever possible. Our Test environment is built to support iteration and testing, and has different rate limits than our Live environment.

In cases where you do need to run tests using your Live project keys, you may need to create more than one test account that you can use during your testing flows in order to avoid hitting rate limits specific to an individual email address, phone number, or Stytch Member.