Bearer token in Postman - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to set the Authorization header with a Bearer token in Postman.

Postman

pm.request.headers.add({ key: 'Authorization', value: 'Bearer [1]' });

Drag options to blanks, or click blank then click option'

AaccessToken

BapiKey

Ctoken

DsessionId

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'apiKey' or 'sessionId' instead of the token variable.

Forgetting to include the 'Bearer ' prefix.

The Authorization header for Bearer tokens uses the keyword 'Bearer' followed by the token value. Here, 'token' is the correct variable holding the token.

2fill in blank

medium

Complete the test script to check if the response has a Bearer token in the Authorization header.

Postman

pm.test('Response has Bearer token', () => { pm.expect(pm.response.headers.get('Authorization')).to.include('[1]'); });

Drag options to blanks, or click blank then click option'

ABearer

BToken

CBasic

DOAuth

Attempts:

3 left

💡 Hint

Common Mistakes

Checking for 'Token' or 'Basic' which are different schemes.

Using lowercase 'bearer' which may cause case sensitivity issues.

The Authorization header for Bearer tokens always includes the word 'Bearer'. This test checks that the header contains 'Bearer'.

3fill in blank

hard

Fix the error in this script that sets the Bearer token from environment variable 'authToken'.

Postman

pm.request.headers.upsert({ key: 'Authorization', value: 'Bearer [1]' });

Drag options to blanks, or click blank then click option'

Apm.variables.get('authToken')

Bpm.environment.get('authToken')

Cpm.globals.get('authToken')

Dpm.request.get('authToken')

Attempts:

3 left

💡 Hint

Common Mistakes

Using pm.variables.get() or pm.globals.get() which fetch different scopes.

Trying to get token from pm.request which is incorrect.

To get an environment variable in Postman scripts, use pm.environment.get('variableName'). This correctly fetches 'authToken'.

4fill in blank

hard

Fill both blanks to extract the Bearer token from the Authorization header and save it to an environment variable.

Postman

const authHeader = pm.response.headers.get('[1]');
const token = authHeader.split('[2]')[1].trim();
pm.environment.set('bearerToken', token);

Drag options to blanks, or click blank then click option'

AAuthorization

BBearer

D:

Attempts:

3 left

💡 Hint

Common Mistakes

Using wrong header key like 'Auth' or 'Token'.

Splitting by ' ' (space) instead of 'Bearer ' which includes the word.

The Authorization header key is 'Authorization'. The token is after the string 'Bearer ' (with a space), so splitting by 'Bearer ' extracts the token.

5fill in blank

hard

Fill all three blanks to write a test that verifies the Bearer token is present and not empty in the Authorization header.

Postman

pm.test('Bearer token is present and valid', () => {
  const authHeader = pm.response.headers.get('[1]');
  pm.expect(authHeader).to.exist;
  pm.expect(authHeader).to.match(/^[2]\s+\S+$/);
  const token = authHeader.split('[3]')[1];
  pm.expect(token.length).to.be.above(0);
});

Drag options to blanks, or click blank then click option'

AAuthorization

BBearer

CBearer

DToken

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'Token' instead of 'Bearer' in regex or split.

Forgetting the space after 'Bearer' in split.

The header key is 'Authorization'. The regex checks the header starts with 'Bearer' followed by space and token. Splitting by 'Bearer ' extracts the token.

Practice

1. What is the correct way to include a Bearer token in a Postman request header?

easy

A. Add a query parameter named 'token' with the token value

B. Set the Authorization header to 'Bearer <token>'

C. Include the token in the request body as JSON

D. Set a cookie named 'Bearer' with the token value

Solution

1. Step 1: Understand Bearer token usage in headers

   Bearer tokens are sent in the Authorization header to prove identity.

2. Step 2: Identify correct header format

   The header must be 'Authorization: Bearer <token>' exactly.

3. Final Answer:

   Set the Authorization header to 'Bearer <token>' -> Option B

4. Quick Check:

   Authorization header = Bearer token [OK]

Hint: Always use Authorization header with 'Bearer ' prefix [OK]

Common Mistakes:

• Putting token in query parameters instead of header
• Sending token in request body instead of header
• Using cookie instead of Authorization header

2. Which of the following is the correct syntax to add a Bearer token in Postman headers?

easy

A. "Auth": "Bearer <token>"

B. "Authorization": "Token <token>"

C. "Authorization": "Bearer <token>"

D. "Authorization": "Basic <token>"

Solution

1. Step 1: Recall correct header key and value format

   The header key must be 'Authorization' and the value must start with 'Bearer '.

2. Step 2: Match the exact syntax

   Only "Authorization": "Bearer <token>" uses 'Authorization' and 'Bearer <token>' correctly.

3. Final Answer:

   "Authorization": "Bearer <token>" -> Option C

4. Quick Check:

   Authorization = Bearer token syntax [OK]

Hint: Remember header key is 'Authorization' and value starts with 'Bearer ' [OK]

Common Mistakes:

• Using 'Token' instead of 'Bearer' prefix
• Using 'Auth' instead of 'Authorization' header
• Confusing 'Basic' auth with Bearer token

3. Given this Postman test script snippet, what will be the value of the Authorization header sent?

pm.request.headers.add({key: 'Authorization', value: `Bearer ${pm.environment.get('token')}`});

medium

A. Authorization: Bearer <token_value_from_environment>

B. Authorization: Token <token_value_from_environment>

C. Authorization: Bearer undefined

D. Authorization: Basic <token_value_from_environment>

Solution

1. Step 1: Understand the code usage of environment variable

   The code uses pm.environment.get('token') to get the token value from environment variables.

2. Step 2: Analyze the header value construction

   The header value is 'Bearer ' plus the token value from environment, so it will be 'Bearer <token_value_from_environment>'.

3. Final Answer:

   Authorization: Bearer <token_value_from_environment> -> Option A

4. Quick Check:

   Header value = 'Bearer ' + environment token [OK]

Hint: Check environment variable usage inside template literals [OK]

Common Mistakes:

• Assuming token is 'undefined' if environment variable missing
• Using 'Token' instead of 'Bearer' prefix
• Confusing Basic auth with Bearer token

4. You added a Bearer token in Postman but the API returns 401 Unauthorized. What is the most likely mistake?

medium

A. The Authorization header is missing the 'Bearer ' prefix

B. The token is placed in the request body instead of headers

C. The Content-Type header is set to 'application/json'

D. The token is expired or invalid

Solution

1. Step 1: Check common causes of 401 Unauthorized with Bearer tokens

   401 usually means token is missing, malformed, or invalid/expired.

2. Step 2: Identify the most likely cause given the token is added

   If the token is added correctly but still 401, it is likely expired or invalid.

3. Final Answer:

   The token is expired or invalid -> Option D

4. Quick Check:

   401 Unauthorized often means invalid token [OK]

Hint: Check token validity if 401 despite correct header [OK]

Common Mistakes:

• Forgetting 'Bearer ' prefix in Authorization header
• Placing token in body instead of header
• Assuming Content-Type affects authorization

5. You want to automate testing of an API that requires a Bearer token which expires every hour. Which approach is best to handle this in Postman?

hard

A. Use a Pre-request Script to fetch a new token and set it dynamically before each request

B. Manually update the token in environment variables before each test run

C. Hardcode the token in the Authorization header and ignore expiration

D. Remove the Authorization header to avoid token expiration errors

Solution

1. Step 1: Understand token expiration and automation needs

   Since the token expires hourly, manual updates are inefficient and error-prone.

2. Step 2: Choose dynamic token fetching in Pre-request Script

   Using a Pre-request Script to get a fresh token before each request automates the process and avoids failures.

3. Final Answer:

   Use a Pre-request Script to fetch a new token and set it dynamically before each request -> Option A

4. Quick Check:

   Automate token refresh with Pre-request Script [OK]

Hint: Automate token refresh with Pre-request Script [OK]

Common Mistakes:

• Manually updating tokens wastes time and causes errors
• Hardcoding tokens ignores expiration and causes failures
• Removing Authorization header breaks authentication