OAuth 2.0 flow in Postman - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to specify the OAuth 2.0 grant type in Postman.

Postman

pm.environment.set('grant_type', '[1]');

Drag options to blanks, or click blank then click option'

Aclient_credentials

Brefresh_token

Cpassword

Dauthorization_code

Attempts:

3 left

💡 Hint

Common Mistakes

Using client_credentials grant type which is for server-to-server authentication.

Using password grant type which requires user credentials directly.

The authorization_code grant type is used to obtain an access token via an authorization code in OAuth 2.0 flow.

2fill in blank

medium

Complete the code to set the token URL for OAuth 2.0 in Postman.

Postman

pm.environment.set('token_url', '[1]');

Drag options to blanks, or click blank then click option'

Ahttps://api.example.com/userinfo

Bhttps://api.example.com/token

Chttps://api.example.com/authorize

Dhttps://api.example.com/auth

Attempts:

3 left

💡 Hint

Common Mistakes

Confusing the authorize URL with the token URL.

Using userinfo endpoint as token URL.

The token URL is where Postman sends the request to exchange the authorization code for an access token.

3fill in blank

hard

Fix the error in the code to correctly set the client ID in Postman environment.

Postman

pm.environment.set('client_id', [1]);

Drag options to blanks, or click blank then click option'

A1234567890abcdef

B"1234567890abcdef"

C'1234567890abcdef'

Dclient_id_value

Attempts:

3 left

💡 Hint

Common Mistakes

Not using quotes around the client ID string.

Using double quotes inside double quotes without escaping.

The client ID must be a string, so it needs to be enclosed in quotes when setting in Postman environment.

4fill in blank

hard

Fill both blanks to correctly extract and save the access token from the OAuth 2.0 response in Postman.

Postman

const response = pm.response.json();
pm.environment.set('[1]', response.[2]);

Drag options to blanks, or click blank then click option'

Aaccess_token

Btoken

CaccessToken

Dtoken_value

Attempts:

3 left

💡 Hint

Common Mistakes

Using incorrect property names like 'token' or 'accessToken' if the API uses 'access_token'.

Mismatching environment variable name and JSON property.

The access token is usually found in the access_token field of the OAuth 2.0 response JSON.

5fill in blank

hard

Fill all three blanks to create a test in Postman that checks if the OAuth 2.0 access token is present and valid.

Postman

pm.test('Access token is present', () => {
  const jsonData = pm.response.json();
  pm.expect(jsonData.[1]).to.be.a('[2]');
  pm.expect(jsonData.[3].length).to.be.greaterThan(10);
});

Drag options to blanks, or click blank then click option'

Aaccess_token

Bstring

Dtoken

Attempts:

3 left

💡 Hint

Common Mistakes

Using wrong property names like 'token' instead of 'access_token'.

Checking for wrong data types or missing length check.

This test checks that the access_token exists, is a string, and has a length greater than 10 characters, indicating a valid token.