This question is related to the problem described in a following StackOverflow question: authentication - Getting access tokens from Postman: Tokens issued for the 'Single-Page Application' client-type may only be redeemed via cross-origin requests - Stack Overflow . During OAuth 2.0 “authorization …

Any update on this? This is kind of urgent to test API’s dependent on SPA

Having the same issue, since Microsoft forced PKCE now. Postman is no longer an option for our tests now

Same issue here … please add some feature that we can add header information in the Authorization flow.

Surely if you use sendRequest() in a pre-request script, then you are in full control of what headers are sent.

This doesn’t work for PKCE. PKCE is a client-based flow which involves the use of a browser and redirects.

I have found a solution, hope this works for you: [image]

This is a solution, but refreshing will not work due to the same error as the OP

Add `Origin` header to OAuth 2.0 flow

aridzi (Armin) June 18, 2024, 3:43pm 7

I have found a solution, hope this works for you:

Topic		Replies	Views
Browser-based PKCE auth token automation doesn't work with MS AAD Help Hub authentication	3	561	February 17, 2023
Authorization Header together with Auth config Help Hub authorization	1	705	December 8, 2022
Advanced OAuth2 request with custom header Help Hub oauth2	1	617	February 18, 2025
How to add custom headers to the builtin OAuth token request? Help Hub oauth2	7	9388	March 29, 2023
Postman Flows block does not send Authorization header Help Hub postman-flows	1	71	December 26, 2025