(Optional) Add authentication to your spike script

Spike tests are only realistic when they hit the same code paths as production. Protected routes often add token validation, caching, and rate limits that an unauthenticated script never exercises. The standard k6 pattern is to read secrets from the environment, never hard-code them in the script.

To add authentication to your spike requests, complete the following steps:

1. Choose an environment variable name for the credential, for example SPIKE_API_TOKEN. Do not commit real tokens to Git; set the variable only in your shell session, CI secret store, or Grafana Cloud k6 test secrets when you run for real.

2. At the top of your script (below imports), read the token once. Keep your existing export const options block unchanged immediately after:

   JavaScript Copy

   import http from 'k6/http';
   import { check, sleep } from 'k6';
   
   const token = __ENV.SPIKE_API_TOKEN || '';
   
   export const options = {
     stages: [
       /* … your existing stages … */
     ],
     thresholds: {
       /* … your existing thresholds … */
     },
   };

   Copy your real stages and thresholds from spike.js or spike-multi.js in place of the comments.

3. Add a small helper so every request can attach the same headers when a token is present:

   JavaScript Copy

   function authHeaders() {
     if (!token) {
       return {};
     }
     return {
       headers: {
         Authorization: `Bearer ${token}`,
       },
     };
   }

4. Merge those headers into each request. For a GET with URL grouping and tags:

   JavaScript Copy

   const res = http.get(http.url`https://your-api.example.com/api/status`, {
     ...authHeaders(),
     tags: { name: 'GET_status' },
   });

   For POST requests, merge authHeaders().headers into your existing headers object (for example keep Content-Type: application/json and add Authorization in the same object).

5. Run the script with the variable set for one local check:

   Bash Copy

   SPIKE_API_TOKEN=your-staging-token k6 run spike.js

   Confirm that status checks match what your API returns for valid credentials (200/204) versus missing or invalid tokens (401/403).

Open Turn spike results into action in the sidebar to plan follow-up work.