Skip to content
Postman API Testing Tips

How To Sign In Into The Postman Using Appllication

API Testing Blog

Authenticating with Postman using Applications

Postman is a powerful tool for API testing, and often, to access certain endpoints or features, you need to authenticate. This guide will show you how to authenticate with Postman using various applications.

1. Authentication using Environment Variables:

This method is ideal for storing sensitive information, like API keys or tokens, securely outside your main request code.

Step 1: Create an Environment:

  • In Postman, click on the “Environments” tab.
  • Click the “Add” button and give your Environment a name (e.g., “My API Environment”).

Step 2: Add Variables:

  • Click on the “Add” button within the Environment’s variables section.
  • Create variables for your authentication credentials: auth_token, api_key, etc.
  • Set their values based on your application’s requirements.

Step 3: Utilize Variables in requests:

{
  "method": "GET",
  "url": "https://api.example.com/users",
  "headers": {
    "Authorization": "Bearer {{auth_token}}"
  }
}
  • Replace {{auth_token}} with your variable name.
  • When you send the request, Postman will automatically substitute the variable with its value from your environment.

Step 4: Select your environment:

  • Before running a test, ensure the correct Environment is selected in the top right corner of the Postman interface.

Example:

  • For a simple authentication example using a token:
    • auth_token variable with the value your_token.
    • Request Body:
    {
        "method": "GET",
        "url": "https://api.example.com/users",
        "headers": {
            "Authorization": "Bearer {{auth_token}}"
        }
    }

2. Authentication Using Basic Auth:

Basic Authentication is often used when you have a username and password to authenticate.

Step 1: Configure Basic Auth:

  • In the request tab, click on the “Authorization” tab.
  • Select “Basic Auth” from the dropdown menu.
  • Enter your “Username” and “Password” in the respective fields.

Step 2: Send the Request:

  • Postman will automatically send the encoded credentials in the Authorization header.

Example:

  • Assuming your username is user and password is password:
    • In the Authorization tab, select “Basic Auth”.
    • Enter your username user and password password.
    • When you send the request, the Authorization header will look like this: Authorization: Basic dXNlcjpwYXNzd29yZA== (encoded credentials).

3. Authentication using OAuth 2.0:

OAuth 2.0 is a common standard for delegated authorization, allowing applications to access protected resources on behalf of users.

Step 1: Configure OAuth 2.0:

  • In the request tab, click on the “Authorization” tab.
  • Select “OAuth 2.0” from the dropdown menu.
  • Fill in the required details:
    • Grant type: This can be authorization_code, password, client_credentials, etc.
    • Token URL: The endpoint for obtaining an access token.
    • Client ID: Your application’s client ID.
    • Client secret: Your application’s client secret.
    • Scope: The permissions requested from the user (if applicable).
    • Additional parameters: Other parameters as needed by the specific authentication flow.

Step 2: Generate an Access Token:

  • Click on “Get New Access Token.”
  • Depending on the grant type, you may be redirected to a login page or a page to authorize your application.
  • After successful authentication, Postman will retrieve an access token and save it in the current environment.

Step 3: Use the Access Token in your request:

  • In the “Authorization” tab, select “Bearer Token” from the dropdown menu.
  • In the Token field, use the {{access_token}} variable (it will be automatically filled in with the retrieved access token from the environment).

Example:

  • Assuming you are using the authorization code grant flow, the Authorization header in your request body would look like this:
{
    "method": "GET",
    "url": "https://api.example.com/users",
    "headers": {
         "Authorization": "Bearer {{access_token}}"
    }
}
  • Make sure to replace {{access_token}} with the variable containing your access token.

4. Authentication Using API Keys:

Many APIs use simple API keys for authentication.

Step 1: Utilize Environment Variables for API Keys:

  • Follow the steps outlined in the “Authentication using Environment Variables” section.
  • Create a variable for your API key (e.g., api_key).

Step 2: Add API Key to the Request:

  • Add the api_key to the headers section of your request with a specific key name, as defined by the API documentation.
{
  "method": "GET",
  "url": "https://api.example.com/users",
  "headers": {
    "X-API-Key": "{{api_key}}"
  }
}

Step 3: Customize Headers:

  • Replace X-API-Key with the correct header name provided by the API documentation.
  • Ensure you select the correct environment with your API key variable before sending the request.

5. Using Postman Collections for Complex Authentication Scenarios:

  • Store Authentication Logic: For scenarios where you have multiple authentication steps or need to handle dynamic tokens, use Postman Collections.
  • Organize Requests: Organize your tests into collections, making your workflow more structured.
  • Pre-Request Scripts: Write JavaScript code in Pre-request scripts for complex logic.

Example:

  • Collection Structure: Organize your collection into requests:

    • Authentication requests (e.g., “Get Access Token”).
    • Requests that require authentication (e.g., “Get User Profile”).

  • Pre-Request Script in “Get Access Token” Request:

    pm.environment.set("access_token", "your_generated_access_token");
    pm.test("Access Token Retrieved", function () {
        pm.expect(pm.environment.get("access_token")).to.be.a("string");
    });

  • This script retrieves an access token from your backend and stores it in the access_token environment variable.

  • Using the Access Token in the “Get User Profile” Request:

{
    "method": "GET",
    "url": "https://api.example.com/users",
    "headers": {
        "Authorization": "Bearer {{access_token}}"
    }
}
  • When you run the “Get User Profile” request, the access_token environment variable will be automatically populated with the value from the “Get Access Token” request.

By utilizing these techniques, you can effectively authenticate your API requests in Postman, streamlining your testing workflow and maintaining the security of your sensitive information.

API Testing Blog