How do you handle OAuth 2.0 authentication in Postman?

Answer

OAuth 2.0 in Postman

OAuth 2.0 is the modern standard for API authorization. Postman has a built-in OAuth 2.0 flow manager.

Setup Steps

✓Go to the Authorization tab of your request or collection
✓Select Type: OAuth 2.0
✓Click Get New Access Token
✓Configure the token request:

Field	Value
Token Name	My API Token
Grant Type	Authorization Code / Client Credentials
Callback URL	`https://oauth.pstmn.io/v1/callback`
Auth URL	`https://auth.example.com/oauth/authorize`
Access Token URL	`https://auth.example.com/oauth/token`
Client ID	`your-client-id`
Client Secret	`your-client-secret`
Scope	`read:users write:users`

✓Click Request Token → Postman opens the login/consent page
✓Log in and authorize
✓Postman stores the token — click Use Token

Client Credentials Grant (Machine-to-Machine)

For server-to-server auth (no user login):

✓Grant Type: Client Credentials
✓Only needs: Access Token URL, Client ID, Client Secret

JavaScript

// Or get token manually via script
pm.sendRequest({
    url: "https://auth.example.com/oauth/token",
    method: "POST",
    header: { "Content-Type": "application/x-www-form-urlencoded" },
    body: {
        mode: "urlencoded",
        urlencoded: [
            { key: "grant_type", value: "client_credentials" },
            { key: "client_id", value: pm.environment.get("client_id") },
            { key: "client_secret", value: pm.environment.get("client_secret") }
        ]
    }
}, function(err, res) {
    pm.environment.set("access_token", res.json().access_token);
});

Auto-Refresh Tokens

Enable Auto-refresh token in Postman to automatically fetch a new token before it expires.

Best Practices

✓Store client_id and client_secret in environment variables
✓Use Secret variable type for sensitive values
✓Set token expiry time to auto-refresh