How do you handle authentication in Cypress tests?

Authentication is setup, not the behaviour most tests care about. A full UI login in every test makes the suite slower and couples unrelated tests to the login form. The usual patterns are an API login that sets a cookie, a programmatic token, or a single UI login wrapped in cy.session.

Cypress.Commands.add("loginByApi", (email: string, password: string) => {
  cy.request({
    method: "POST",
    url: "/api/auth/login",
    body: { email, password },
  }).then((response) => {
    cy.setCookie("session", response.body.token);
  });
});

Choose the setup

• API login plus cookie: fast and stable when the backend supports it
• UI login wrapped in cy.session: realistic and cached for the spec or suite
• cy.session with validate: re-checks a cached session before reusing it
• cy.origin: required when the login provider is on another origin
• Do not hard-code production credentials; use test users from environment variables

Whichever path you choose, assert that authentication actually succeeded before the test proceeds. A silent failure to log in produces confusing downstream failures. cy.session in particular restores cookies and storage, so the assertion belongs inside the setup function.