Authorization

The Authorization tab adds credentials to a request when it’s sent: a header, a query parameter, or a signature computed from the request itself. Set it once on a collection or folder and every request inside inherits it, or give a single request its own. The client supports 11 auth types, the same ones Postman collections use, so imported collections keep working.

Set auth on a request

123

A request inheriting auth tells you what it resolves to.

1. Authorization tab; a dot appears when the request sets its own auth
2. Type
3. What the inherited auth resolves to

×

1. Open the request and click Authorization.
2. Pick a Type. Its fields appear below, with a one-line hint about what it does.
3. Fill in the fields. Every field accepts {{variables}} and {{vault:name}}, resolved when you send.
4. Send the request, then open the response’s Request tab to see the header or parameters that were added.

Fields for secrets (passwords, tokens, keys) show as dots; the eye button reveals them. Fields with a fixed set of choices are menus; when you haven’t chosen, the first choice applies.

Auth fields are saved in the request file

Masking only hides a value on screen. Whatever you type in an auth field is saved in the request’s JSON file, committed if you use Git, and included in Postman exports. Store credentials in a secret variable or the Vault and put the reference in the field instead, for example {{vault:stripe_key}}. See Variables and environments.

How inheritance works

Requests and folders default to Inherit auth from parent. When you send, the client looks for auth in this order and uses the first it finds:

1. The request’s own type, if it isn’t Inherit auth from parent.
2. The nearest folder above it that doesn’t inherit, closest first.
3. The collection’s auth.
4. Otherwise, No Auth.

A collection can’t inherit: its Authorization tab offers every type except Inherit auth from parent, with the note “Every request in the collection uses this unless it sets its own.”

When a request inherits, its tab says what it resolves to, for example “This request uses Bearer Token from its parent folder or collection.” Choose No Auth on a request or folder to send nothing even though a parent has auth.

Variables in inherited auth resolve with the request’s own scopes, so a collection-level {{token}} can come from whichever environment is active.

Auth types

Type	What it does
Inherit auth from parent	Uses the folder’s or collection’s auth. Not available on collections.
No Auth	Sends no authorization.
API Key	Adds a key as a header or query parameter.
Bearer Token	Sends Authorization: Bearer <token>.
JWT Bearer	Signs a JSON Web Token on every send and sends it as a bearer token or query parameter.
Basic Auth	Sends the username and password Base64-encoded in Authorization: Basic.
Digest Auth	Answers the server’s 401 Digest challenge automatically.
OAuth 1.0	Signs each request (RFC 5849).
OAuth 2.0	Sends an access token, and gets one for you through the browser or directly.
Hawk Authentication	Signs each request with a Hawk MAC.
AWS Signature	Signs the request with AWS Signature Version 4.
Akamai EdgeGrid	Signs the request for Akamai {OPEN} APIs (EG1-HMAC-SHA256).

API Key

Field	What it’s for
Key	The header or parameter name, such as X-API-Key. Nothing is added while it’s empty.
Value	The key itself. Secret.
Add to	Header (default) sets the header; Query Params appends key=value to the URL.

Bearer Token

Field	What it’s for
Token	The token. Secret. Nothing is added while it’s empty.
Prefix	The word before the token. Empty means Bearer. Use it for schemes like Token or JWT.

JWT Bearer

The client builds and signs a new token each time you send, so time-based claims are always fresh.

Field	What it’s for
Algorithm	HS256 (default), HS384, HS512, RS256, RS384, RS512 or ES256.
Secret or private key (PEM)	For HS*, the shared secret. For RS*, an RSA private key in PEM (PKCS #1 or PKCS #8). For ES256, a P-256 private key in PEM. Secret.
Secret is Base64 encoded	true decodes the HMAC secret from Base64 before signing. Default false.
Payload (JSON)	The claims, as a JSON object. Empty sends {"iat": <now>}.
Extra JWT headers (JSON)	A JSON object merged into the token header after alg and typ, for example {"kid": "key-1"}.
Add token to	Header (default) or Query Params.
Header prefix	The word before the token in Authorization. Empty means Bearer.
Query parameter	The parameter name when adding to the query. Empty means token.

With ES256 selected, Generate a Test Key fills in a new P-256 private key so you can try signing without one.

Payload (JSON)

{
  "sub": "ada@example.com",
  "scope": "read:pets",
  "iat": {{$timestamp}}
}

Basic Auth

Field	What it’s for
Username	The user name.
Password	The password. Secret.

The header is always sent, even with empty fields.

Digest Auth

The client first sends the request without credentials. When the server answers 401 with a WWW-Authenticate: Digest … challenge, the client copies the challenge’s realm, nonce, qop, opaque and algorithm, computes the response and sends the request once more. You usually fill in only the username and password.

Field	What it’s for
Username	The user name.
Password	The password. Secret.
Realm	Filled from the server’s challenge.
Nonce	Filled from the server’s challenge. When you set it yourself, the first request already carries a Digest header.
Algorithm	MD5 (default), MD5-sess, SHA-256 or SHA-256-sess.
qop	Quality of protection: auth or auth-int (which also hashes the body).
Opaque	Sent back unchanged if the server provided one.

OAuth 1.0

Field	What it’s for
Signature method	HMAC-SHA1 (default), HMAC-SHA256 or PLAINTEXT.
Consumer key	Your app’s consumer key.
Consumer secret	Your app’s consumer secret. Secret.
Access token	The user’s token, if you have one.
Token secret	The token’s secret. Secret.
Callback URL	Sent as oauth_callback when set.
Verifier	Sent as oauth_verifier when set.
Realm	Added to the Authorization header when set.
Add to	Header (default, Authorization: OAuth …), Query Params, or Request Body (appended as form fields).

The signature covers the method, the URL, its query parameters and, for application/x-www-form-urlencoded bodies, the form fields. The URL must be absolute.

OAuth 2.0

OAuth 2.0 has two jobs: getting an access token, and sending it. The token is sent on every request; the button below the fields gets a new one.

Field	Shown for	What it’s for
Access token	All grants	The token sent with requests. Filled in by Get New Access Token. Secret.
Header prefix	All grants	The word before the token. Empty means Bearer.
Add token to	All grants	Header (default) sends Authorization: <prefix> <token>; Query Params adds access_token=<token> to the URL.
Grant type	All grants	Authorization Code (default), Authorization Code (with PKCE), Client Credentials, Password Credentials or Refresh Token.
Auth URL	Authorization code grants	The provider’s authorization endpoint, opened in your browser.
Access token URL	All grants	The provider’s token endpoint.
Client ID	All grants	Your app’s client ID.
Client secret	All grants	Your app’s client secret. Leave it empty for public clients. Secret.
Scope	All grants	Space-separated scopes, sent when set.
Callback URL	Authorization code grants	The redirect URI. Empty means http://127.0.0.1:53682/callback.
Username	Password Credentials	The resource owner’s user name.
Password	Password Credentials	The resource owner’s password. Secret.
Refresh token	Refresh Token, or when one was received	Filled in when the provider returns one. Secret.
Audience	All grants	Sent as audience when set (used by Auth0 and similar providers).
Client authentication	All grants	Header (default) sends the client ID and secret as Basic auth to the token endpoint; Request Body sends them as client_id and client_secret form fields. With no secret, the client ID always goes in the body.

Get an OAuth 2.0 access token

Authorization code

1. Fill in Auth URL, Access token URL, Client ID and, for confidential clients, Client secret. Choose Authorization Code (with PKCE) if the provider supports it.
2. Register the Callback URL with your provider. Leave the field empty to use http://127.0.0.1:53682/callback, or set any http://127.0.0.1:PORT/… address.
3. Click Get New Access Token. Your browser opens the provider’s sign-in page, and the status reads “Waiting for you to sign in in the browser…”.
4. Sign in and approve. The browser lands on a local page that says “Signed in. You can close this tab and return to Cloak Proxy.”
5. The client exchanges the code for a token and fills in Access token (and Refresh token when the provider sends one). The status shows when the token expires.

The client listens on the callback port only while it waits, for up to five minutes, and checks the state value so a stray redirect can’t complete the sign-in. With PKCE it sends an S256 code challenge.

Client credentials

1. Choose Client Credentials.
2. Fill in Access token URL, Client ID, Client secret and, if needed, Scope and Audience.
3. Click Get New Access Token. The client calls the token endpoint and fills in Access token.

Password

1. Choose Password Credentials.
2. Fill in Access token URL, Client ID, Username, Password and any Scope.
3. Click Get New Access Token.

Refresh token

When a token response includes a refresh token, a Refresh Token button appears next to Get New Access Token. Click it to get a new access token with the refresh token, without signing in again. You can also choose the Refresh Token grant and paste a refresh token yourself.

Token requests go through Cloak Proxy, so you can inspect them in the traffic list. If the provider returns an error, the status shows it, for example “OAuth error invalid_client: …”.

If you send a request before getting a token, it goes out without one and the Console tab warns: “OAuth 2.0 has no access token yet. Use Get New Access Token in the Auth tab.”

Fetched tokens are saved with the request

Get New Access Token writes the access and refresh tokens into the request, folder or collection where you set up OAuth 2.0, which means its JSON file. If the workspace is in Git, don’t commit while a live token is in there, or keep OAuth 2.0 on a collection in a repository only you use.

Hawk Authentication

Field	What it’s for
Hawk Auth ID	Your Hawk key ID.
Hawk Auth Key	The shared key. Secret.
Algorithm	sha256 (default) or sha1.
User	Saved with the request and kept in Postman exports. It isn’t part of the signature.
ext	Extra application data, included in the MAC and the header.
app	Application ID, included in the MAC and the header when set.
dlg	Delegated-by application ID, included along with app.
Include payload hash	true adds a hash of the body and its content type. Default false.

The URL must be absolute.

AWS Signature

Field	What it’s for
Access key	Your AWS access key ID.
Secret key	Your AWS secret access key. Secret.
Region	Empty means us-east-1.
Service name	Empty means execute-api (API Gateway). Use s3, lambda, sqs and so on for other services.
Session token	For temporary credentials; sent as X-Amz-Security-Token. Secret.

The client adds X-Amz-Date and a Host header if missing, signs the method, path, query, headers and body hash, and sets Authorization: AWS4-HMAC-SHA256 …. For s3 it also sends X-Amz-Content-Sha256 and signs the path as written.

Akamai EdgeGrid

Field	What it’s for
Access token	From your Akamai API client credentials. Secret.
Client token	From your credentials. Secret.
Client secret	From your credentials. Secret.
Headers to sign	Comma-separated header names to include in the signature. Usually empty.
Max body size	How many bytes of a POST body to hash. Empty means 131072.

The URL must be absolute.

When auth is applied

Auth is added after pre-request scripts run and variables are resolved, just before the request goes out. That means:

• A pre-request script can set the variable an auth field uses, for example pm.environment.set("token", …), and that send uses the new value.
• Signatures (OAuth 1.0, Hawk, AWS, EdgeGrid, JWT) cover the request as it’s actually sent.
• Code snippets and Copy as cURL don’t include auth, because it’s only added when the request is sent. To include it, set the header yourself.
• pm.sendRequest calls from scripts don’t use the request’s auth. Add headers to them yourself. pm.execution.runRequest runs a saved request with its own auth.

If signing fails, for example a malformed PEM key, the request isn’t sent and the response area shows the reason, prefixed with “Auth:”.

Auth from imports

• Postman collections keep their auth, mapped field by field, including inheritance. Types Cloak Proxy doesn’t have, such as NTLM, become No Auth so the rest of the collection still works.
• OpenAPI imports set collection auth from the spec’s first security scheme, with variables for the credentials: {{apiKey}}, {{bearerToken}}, {{username}} and {{password}}, or {{accessToken}}, {{clientId}} and {{clientSecret}} with the token URL filled in for OAuth 2.0.

See Import and export.

Related

Variables and environmentsKeep credentials in secret variables and the Vault.

Collections and requestsCollection and folder settings.

Scripts and testsFetch and set tokens from scripts.

Workspace and GitWhat gets committed and what stays local.