API testing is not only about validating functionality but also about ensuring that sensitive data, authentication tokens, and credentials are handled securely. Tools like Postman make API testing easy, but improper configuration can expose tokens, passwords, and user data.
Most APIs use tokens for authentication. These tokens must never be hardcoded inside requests or shared publicly. Postman provides environments and variables to safely manage such values.
Note: "Current Value" is kept local to your machine and not synced to Postman servers if configured correctly.
// Using environment variable for authorization token
Authorization: Bearer {{auth_token}}
// Pre-request script to dynamically set a token
pm.environment.set("auth_token","abc123securetoken");
The token is stored securely in an environment variable. During request execution, Postman replaces {{auth_token}} with the actual value without exposing it in the request URL.
Click the button below to simulate masking sensitive data in logs.
Enter a mock API token to see how a security script would mask it for logs:
// Mask sensitive data before logging
function mask(value){
return value.replace(/.(?=.{4})/g,"*");
}
console.log(mask("mysecrettoken123"));