OAuth 2.0 flow in Postman

Introduction

OAuth 2.0 flow helps apps get permission to access user data safely without sharing passwords.

When testing APIs that require user login without exposing passwords.

When automating API tests that need access tokens for authorization.

When verifying that your app correctly handles user permissions.

When checking if token refresh works to keep sessions active.

When simulating user login flows in Postman for API testing.

Syntax

Postman

1. Get Authorization Code by redirecting user to auth URL.
2. Exchange Authorization Code for Access Token.
3. Use Access Token to call protected APIs.
4. Refresh Access Token when expired (optional).

Each step involves HTTP requests with specific parameters.

Postman can automate these steps using its OAuth 2.0 helper.

Examples

This URL asks the user to authorize and returns an authorization code.

Postman

GET https://authserver.com/auth?response_type=code&client_id=abc123&redirect_uri=https://app.com/callback&scope=read

This request exchanges the authorization code for an access token.

Postman

POST https://authserver.com/token
Headers: Content-Type: application/x-www-form-urlencoded
Body: grant_type=authorization_code&code=AUTH_CODE&redirect_uri=https://app.com/callback&client_id=abc123&client_secret=secret

This request uses the access token to get protected data.

Postman

GET https://api.com/data
Headers: Authorization: Bearer ACCESS_TOKEN

Sample Program

This sequence shows how to perform OAuth 2.0 flow manually in Postman to get and use an access token.

Postman

1. Open Postman.
2. Create a new request to the authorization endpoint:
   GET https://authserver.com/auth?response_type=code&client_id=abc123&redirect_uri=https://app.com/callback&scope=read
3. Simulate user login and get the authorization code from the redirect URL.
4. Create a POST request to the token endpoint:
   POST https://authserver.com/token
   Headers: Content-Type: application/x-www-form-urlencoded
   Body (x-www-form-urlencoded):
     grant_type=authorization_code
     code=RECEIVED_AUTH_CODE
     redirect_uri=https://app.com/callback
     client_id=abc123
     client_secret=secret
5. Extract access_token from the JSON response.
6. Use the access_token in the Authorization header to call protected API:
   GET https://api.com/data
   Headers: Authorization: Bearer ACCESS_TOKEN

Important Notes

Always keep client_secret safe and never expose it publicly.

Tokens usually expire; use refresh tokens if available to get new access tokens.

Postman has built-in OAuth 2.0 support to automate these steps easily.

Summary

OAuth 2.0 flow lets apps access user data securely without passwords.

It involves getting an authorization code, exchanging it for a token, then using the token.

Postman can help test this flow step-by-step or automatically.