API authentication and authorization in Postman | Postman Learning Center (2024)

FAQs

How do you handle authentication and Authorization in Postman? ›

To set up authentication for your public APIs, go to the API authorization dashboard. Select Team > Team Settings in the Postman header, then select Set up API authorization in the left sidebar. Postman supports Bearer Token, Basic Auth, API Key, and OAuth 2.0 authorization.

In other words, Authentication proves that you are who you say you are. Authorization is when an entity proves a right to access. In other words, Authorization proves you have the right to make a request. Essentially, API authentication is a system that proves your identity.

In the case of REST API, authentication takes place by using HTTP requests. The process of authentication is not complicated. A REST request can carry a special header which can be named Authorization header. This header has information like username and password in some particular form.

Authorization methods are mechanisms used to authenticate and grant access to protected resources within an API or web application. These methods may include Basic Auth, OAuth 1.0, OAuth 2.0, Bearer Token, generating signed JWTs, API Key, Hawk Auth, and Digest Auth.

Luckily, various options exist for authenticating requests. This blog post will explain four popular methods: API Keys, OAuth 2.0, HTTP Authentication Schemes, and JWT Authentication. Now let's dive into these technologies one by one to get our virtual “party” running securely.

If you enter your auth details in the Authorization tab of a request, Postman will automatically populate the relevant parts of the request for your chosen auth type. You can use variables and collections to store authorization details, enabling you to reuse the same information in multiple places.

Basic authentication is a simple and fast method of HTTP authentication. To access the API endpoint, the user must send a username and password to the API provider in the authentication header of the request. The API provider checks the credentials and, in the case of success, grants access to the user.

Basic auth

Basic authentication involves sending a verified username and password with your request. In the request Authorization tab, select Basic Auth from the Type dropdown list. Enter your API username and password in the Username and Password fields. For extra security, store these in variables.

In simple terms, authentication is the process of verifying who a user is, while authorization is the process of verifying what they have access to. Comparing these processes to a real-world example, when you go through security in an airport, you show your ID to authenticate your identity.

API keys are for projects, authentication is for users

The main distinction between these two is: API keys identify the calling project — the application or site — making the call to an API. Authentication tokens identify a user — the person — that is using the app or site.

How can I authenticate API requests? ›

To authenticate API requests, use basic authentication with your email address and password, your email address and an API token, or an OAuth access token. All methods of authentication set the authorization header differently. Credentials sent in the payload or URL are not processed.

From the collection that you downloaded and opened in Postman, select a request. In the Authorization section, open the TYPE menu and select OAuth2 from the list. Open the Available Tokens menu and select a saved token. The token will be added to your selected API request.