Skip to content
Postman API Testing Tips

How To Use Authorization In Postman

API Testing Blog

Understanding Authorization in Postman

Before diving into the practical examples, let’s understand what authorization is and why it’s crucial in API testing.

Authorization is the process of verifying if a user or application has the necessary permissions to access a specific resource. It’s a fundamental security measure that ensures only authorized entities can interact with your API.

Why Use Authorization in Postman?

  • Simulate Real-World Scenarios: API testing often requires simulating user interactions. Implementing authorization ensures your tests mimic how users would access your API in production, leading to more realistic results.
  • Security Testing: Authorization testing allows you to verify that your API’s security mechanisms are robust, preventing unauthorized access and data breaches.
  • Enhanced Test Coverage: Incorporating authorization into your tests provides a more comprehensive and effective assessment of your API’s functionality.

How to Implement Authorization in Postman

Postman offers several methods to handle authorization in your API tests:

1. Basic Auth

Basic Authentication is a simple method where the user’s credentials are encoded in a base64 string and sent in the Authorization header.

Steps:

  1. Add Authorization: In your Postman request, select the “Authorization” tab.
  2. Select “Basic Auth.”
  3. Enter your credentials: In the “Username” and “Password” fields, provide the appropriate values.

Example:

{
  "url": "https://api.example.com/users",
  "method": "GET",
  "headers": {
    "Authorization": "Basic dXNlcm5hbWU6cGFzc3dvcmQ=" // Base64 encoded credentials
  }
}

2. Bearer Token Authentication

Bearer tokens are widely used for API authentication. Here, you obtain a token after successful authentication (usually via username/password or OAuth) and pass it in the Authorization header.

Steps:

  1. Add Authorization: In your Postman request, select the “Authorization” tab.
  2. Select “Bearer Token.”
  3. Acquire a Token: You might need to create a separate request to obtain the token first.
  4. Paste the Token: Copy the token from the response of your token request and paste it into the “Token” field.

Example:

{
  "url": "https://api.example.com/protected/data",
  "method": "GET",
  "headers": {
    "Authorization": "Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw" // Sample token
  }
}

3. OAuth 2.0

OAuth 2.0 is a more robust standard for authorization, often used for granting access to third-party applications. Postman simplifies OAuth 2.0 workflows.

Steps:

  1. Configure OAuth 2.0: In the Authorization tab, click “Get New Access Token” and configure your OAuth 2.0 settings, including:
    • Grant Type
    • Client ID
    • Client Secret
    • Scope
    • Token URL
    • Refresh Token URL
  2. Obtain Access Token: Postman will automatically request an access token using your settings.
  3. Use the Token: Postman will automatically add the obtained access token to the Authorization header.

Example:

Note: OAuth 2.0 configurations can be complex. Refer to Postman’s documentation for specific details on your workflow.

4. API Keys

API Keys are simple, often alphanumeric strings used to identify API clients.

Steps:

  1. Add Authorization: In the Authorization tab, select “API Key.”
  2. Enter Key: In the “Key” field, provide your API key.
  3. Select a Key Location: Choose where to send the key (e.g., header, URL, query parameter).

Example:

{
  "url": "https://api.example.com/products",
  "method": "GET",
  "headers": {
    "X-API-Key": "your_api_key"
  }
}

Using Authorization in Postman Collections

For more organized testing, you can manage authorization settings within Postman Collections. This allows you to define authorization information once and reuse it across multiple requests within the collection.

Steps:

  1. Create a Collection: In Postman, create a new collection to group your related API requests.
  2. Add Authorization to Collection: In the collection settings, click “Authorization” and choose your desired authentication method.
  3. Configure Authorization: Configure the specific details (like credentials, token, or API key) for your chosen method.
  4. Run Collection: When you run requests within the collection, the defined authorization settings will be automatically applied.

Best Practices for Authorization in Postman

  • Use Environment Variables: Store sensitive data like API keys and client secrets in environment variables instead of hardcoding them directly into your requests.
  • Test with Different Authorization Types: Ensure your API can handle various authentication mechanisms, as different users or applications might employ different methods.
  • Document Authentication Requirements: Clearly document the supported authentication mechanisms and their requirements for your API.

By incorporating authorization into your Postman API testing workflow, you can achieve more realistic, secure, and comprehensive testing results.

API Testing Blog