← Back to Chapters

Basic & OAuth 2.0 Authentication

? Basic & OAuth 2.0 Authentication

? Quick Overview

Authentication is the process of verifying the identity of a client before allowing access to protected APIs. Postman supports multiple authentication mechanisms such as Basic Authentication, Bearer Token, and OAuth 2.0.

? Key Concepts

  • Basic Auth Uses username and password encoded in Base64
  • Bearer Token Sends access token in Authorization header
  • OAuth 2.0 Token-based delegated authorization framework
  • Postman automatically manages headers when auth type is selected

? Syntax / Theory

In HTTP, authentication credentials are passed using the Authorization header. Different authentication schemes define different formats for this header.

? Code Example — Basic Authentication

? View Code Example 
// Basic Authentication header format
Authorization: Basic dXNlcm5hbWU6cGFzc3dvcmQ=

? Explanation

The username and password are combined as username:password and Base64 encoded. Postman does this automatically when you select Basic Auth.

? Code Example — Bearer Token Authentication

? View Code Example 
// Bearer token sent with every request
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9

? Explanation

Bearer tokens are usually JWTs. The server validates the token and grants access without username/password.

? OAuth 2.0 Token Flow (Postman)

? View Code Example 
// OAuth 2.0 token request parameters
grant_type=authorization_code
client_id=CLIENT_ID
client_secret=CLIENT_SECRET
redirect_uri=https://oauth.pstmn.io/v1/callback
code=AUTH_CODE

? Explanation

Postman opens a browser for login, retrieves the authorization code, and exchanges it for an access token.

? Interactive Flow (Conceptual)

OAuth 2.0 follows this sequence:

  1. User logs in via Authorization Server
  2. Authorization Code is issued
  3. Client exchanges code for Access Token
  4. API requests use the Access Token

? Interactive Lab: Basic Auth Generator

See how Postman works: Enter credentials below to see how they are converted into a Base64 Authentication Header in real-time.

Authorization: Basic ...

? Use Cases

  • Basic Auth for internal or legacy APIs
  • Bearer Tokens for mobile and SPA applications
  • OAuth 2.0 for third-party integrations (Google, GitHub APIs)

✅ Tips & Best Practices

  • Never expose client secrets in frontend apps
  • Prefer OAuth 2.0 over Basic Auth for public APIs
  • Use environment variables in Postman for tokens

? Try It Yourself

  • Create a Postman request using Basic Auth
  • Generate a Bearer Token and reuse it across requests
  • Configure OAuth 2.0 using Authorization Code flow