ReqRes Alternative — Real Auth, Real Persistence
ReqRes is great for a five-minute Postman demo, but its login is hard-coded and writes are simulated. This sandbox runs real JWT and OAuth2 flows, persists your data per session, and exposes the same data over GraphQL and SOAP.
How they compare
| Feature | ReqRes | TotalShiftLeft Sandbox |
|---|---|---|
| Free, no signup | Yes | Yes |
| GET endpoints with paginated lists | Yes | Yes |
| Login returns a real JWT | No (static token string) | Yes (signed JWT with claims) |
| OAuth2 client-credentials flow | No | Yes |
| Refresh tokens | No | Yes |
| POST / PATCH / DELETE persist | No | Yes (session-scoped) |
| GraphQL on same data | No | Yes |
| SOAP on same data | No | Yes |
| OpenAPI 3.0 spec | No | Yes |
| Configurable error / latency simulation | Limited (?delay=) | Yes (error, delay, random_fail) |
Why this matters for testing auth
ReqRes returns the literal string "QpwL5tke4Pnpja7X4" for every "login" — useful for screenshots, useless for actually testing your client's token-refresh logic, expiration handling, role-based access, or 401 / 403 differentiation.
This sandbox issues a real signed JWT with a real exp, supports refresh-token rotation, and has admin / user roles so you can exercise authorization decisions properly.
Quick swap example
# ReqRes
POST https://reqres.in/api/login
{ "email": "eve.holt@reqres.in", "password": "cityslicka" }
# This sandbox (returns a real signed JWT)
POST https://demo.totalshiftleft.ai/auth/token
{ "username": "demo", "password": "demo" }Frequently asked questions
Can I still get fake "delay" behavior like ReqRes?
Yes — append ?delay=2000 to any endpoint for a 2-second artificial latency.
Are the JWTs verifiable?
Yes — they are HS256-signed. The signing secret is intentionally exposed in /auth so you can also fully decode and re-sign locally for negative tests.
Other free public APIs in this sandbox
Open the live sandbox — REST, GraphQL, SOAP and auth in one place. No signup, no API key.
Open the API Sandbox →Topics: ReqRes alternative · reqres.in alternative · free API like ReqRes · ReqRes with real auth · public API for testing login flows