OAuth 2.0 flow in Postman - Build an Automation Script

Test OAuth 2.0 Authorization Code Flow in Postman

Preconditions (3)

Step 1: Open Postman and create a new request

Step 2: Go to the Authorization tab

Step 3: Select OAuth 2.0 as the type

Step 4: Click on Get New Access Token

Step 5: Fill in the fields: Token Name, Auth URL, Access Token URL, Client ID, Client Secret, Scope, Redirect URL

Step 6: Click Request Token

Step 7: Complete the authorization in the browser popup

Step 8: After receiving the token, click Use Token

Step 9: Send the request to the protected resource endpoint

✅ Expected Result: The request is sent with a valid OAuth 2.0 access token in the Authorization header, and the server responds with a successful status code (e.g., 200 OK) and expected data.

Automation Requirements - Postman Test Scripts

Assertions Needed:

Verify response status code is 200

Verify response body contains expected data

Verify Authorization header contains Bearer token

Best Practices:

Use environment variables for client ID, client secret, and URLs

Use Postman pre-request scripts to handle token refresh if needed

Use test scripts to assert response correctness

Avoid hardcoding sensitive data in requests

Automated Solution

Postman

pm.test('Status code is 200', function () {
    pm.response.to.have.status(200);
});

pm.test('Response has expected data', function () {
    const jsonData = pm.response.json();
    pm.expect(jsonData).to.have.property('data');
});

pm.test('Authorization header contains Bearer token', function () {
    const authHeader = pm.request.headers.get('Authorization');
    pm.expect(authHeader).to.match(/^Bearer\s.+$/);
});

The first test checks that the server responded with a 200 OK status, confirming the request succeeded.

The second test parses the JSON response and verifies it contains a property named 'data', which represents expected content from the protected resource.

The third test ensures the Authorization header in the request includes a Bearer token, confirming the OAuth 2.0 token was sent correctly.

Using environment variables and pre-request scripts in Postman helps keep sensitive data secure and automates token management.

Common Mistakes - 3 Pitfalls

Hardcoding client secret and tokens directly in the request

Not verifying the response status code before checking response body

Ignoring token expiration and not refreshing tokens

Bonus Challenge

Now add data-driven testing by running the OAuth 2.0 flow with three different sets of client credentials and scopes

Show Hint