Bearer token in Postman - Build an Automation Script

Verify API access with Bearer token authentication

Preconditions (2)

Step 1: Open Postman

Step 2: Create a new GET request to the API endpoint https://api.example.com/data

Step 3: In the Authorization tab, select Bearer Token

Step 4: Enter the valid Bearer token in the token field

Step 5: Send the request

Step 6: Observe the response status and body

✅ Expected Result: The API responds with status 200 OK and returns the expected data in JSON format

Automation Requirements - Postman (using Postman test scripts)

Assertions Needed:

Response status code is 200

Response body contains expected data fields

Best Practices:

Use environment variables to store Bearer token securely

Validate response status and body with clear assertions

Avoid hardcoding tokens in scripts

Automated Solution

Postman

pm.test('Status code is 200', function () {
    pm.response.to.have.status(200);
});

pm.test('Response has expected data field', function () {
    const jsonData = pm.response.json();
    pm.expect(jsonData).to.have.property('data');
});

The first test checks that the response status code is 200, confirming successful authentication and data retrieval.

The second test parses the JSON response and asserts that it contains a property named 'data', which is expected from the API.

Using pm.test and pm.expect ensures clear, readable assertions in Postman scripts.

Common Mistakes - 3 Pitfalls

Hardcoding the Bearer token directly in the request headers

Not verifying the response status code before checking response body

{'mistake': "Using incorrect token type or missing 'Bearer' prefix", 'why_bad': "The API will reject the request if the token is not properly formatted with 'Bearer' prefix.", 'correct_approach': "Use Postman's Bearer Token authorization type which automatically adds the prefix."}

Bonus Challenge

Now add data-driven testing with 3 different Bearer tokens: one valid, one expired, and one invalid

Show Hint