Token management in variables in Postman - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Token Storage Scope in Postman

In Postman, you want to store an authentication token so it is available only during the current session and not saved permanently. Which variable scope should you use?

A Environment variable

B Temporary variable (using pm.variables.set())

C Collection variable

D Global variable

💡 Hint

Think about which variable scope does not persist after the session ends.

Temporary variables set with pm.variables.set() exist only during the request execution and are not saved permanently, making them ideal for session-only tokens.

❓ Predict Output

intermediate

Output of Token Retrieval from Environment Variable

Given this Postman test script snippet, what will be the console output if the environment variable authToken is not set?

Postman

const token = pm.environment.get('authToken');
console.log(token ?? 'No token found');

A undefined

B null

C No token found

D Error: Variable not found

💡 Hint

Consider what the nullish coalescing operator ?? does when the variable is undefined.

If authToken is not set, pm.environment.get() returns undefined. The expression token ?? 'No token found' evaluates to 'No token found'.

❓ assertion

advanced

Correct Assertion for Token Presence in Global Variable

Which assertion correctly verifies that a global variable accessToken exists and is a non-empty string in Postman test scripts?

A pm.expect(pm.globals.get('accessToken')).to.be.a('string').and.not.empty;

B pm.expect(pm.globals.get('accessToken')).to.be.ok.and.to.have.length.above(0);

C pm.expect(pm.globals.get('accessToken')).to.exist.and.not.equal('');

D pm.expect(pm.globals.get('accessToken')).to.be.a('string').and.not.undefined;

💡 Hint

Check which assertion chain correctly tests type and non-empty string.

Option A uses to.be.a('string') to check type and not.empty to ensure the string is not empty, which is the correct way to assert a non-empty string.

🔧 Debug

advanced

Debugging Token Expiry Handling in Pre-request Script

Consider this pre-request script snippet that refreshes a token if expired. What is the main reason this script might fail to update the token properly?

const expiry = pm.environment.get('tokenExpiry');
const now = Date.now();
if (now > expiry) {
  pm.sendRequest({
    url: 'https://api.example.com/refresh',
    method: 'POST',
    header: { 'Content-Type': 'application/json' },
    body: { mode: 'raw', raw: JSON.stringify({ refreshToken: pm.environment.get('refreshToken') }) }
  }, (err, res) => {
    if (!err && res.code === 200) {
      const json = res.json();
      pm.environment.set('authToken', json.token);
      pm.environment.set('tokenExpiry', Date.now() + json.expiresIn * 1000);
    }
  });
}

A The pm.environment.set calls are inside the callback and will not persist after the script finishes.

B The tokenExpiry variable is stored as a string and cannot be compared with now (number).

C The refreshToken is not included in the request body correctly, causing the refresh to fail.

D The asynchronous pm.sendRequest callback does not block the request, so the token is not updated before the main request runs.

💡 Hint

Think about how asynchronous calls affect the timing of variable updates in Postman scripts.

pm.sendRequest is asynchronous, so the main request proceeds before the token is refreshed and updated. This means the new token is not used in the current request.

❓ framework

expert

Designing a Secure Token Management Strategy in Postman Collections

You want to design a Postman collection that securely manages tokens for multiple environments, automatically refreshes tokens when expired, and avoids token leakage in logs. Which approach best meets these requirements?

A Store tokens in environment variables, refresh tokens in pre-request scripts using pm.sendRequest, and disable console logging of tokens.

B Store tokens in global variables, refresh tokens manually before running requests, and use console.log to verify tokens.

C Store tokens in collection variables, refresh tokens in test scripts after requests, and avoid logging tokens anywhere.

D Store tokens in environment variables, refresh tokens in pre-request scripts with synchronous calls, and mask tokens in console logs.

💡 Hint

Consider variable scope, automation of refresh, and security best practices.

Option A uses environment variables scoped per environment, automates refresh in pre-request scripts asynchronously, and disables logging to prevent token exposure, which aligns with best practices.