How to complete the challenge POST /api/secret/note (Bearer)

By Alan Richardson · Published 2026-07-31

First complete GET /api/secret/token (200) to obtain an X-AUTH-TOKEN value.

Then send POST /api/secret/note with a JSON note payload and use the token as a Bearer token in the Authorization header. Do not send the token as X-AUTH-TOKEN for this challenge.

Try it now

If you do not already have an auth token, retrieve one with GET /api/secret/token. See the solution.

GET /api/secret/token to retrieve an auth token

POST /api/secret/note with a Bearer token to update the secret note

Lessons Learned

• POST /api/secret/note can authorize writes with the standard Authorization: Bearer pattern.
• Bearer-token writes still need the same valid note body and Content-Type.
• This challenge confirms the API accepts bearer auth for state-changing protected operations.

Suggested Experiments

• Update the note with Authorization: Bearer, then read it using X-AUTH-TOKEN to compare header styles.
• Send Authorization: bearer <token> with lowercase scheme and see whether matching is case-sensitive.

Experiment with this endpoint