# Authorization Header together with Auth config

**URL:** <https://community.postman.com/t/authorization-header-together-with-auth-config/41860>\
**Category:** Help Hub\
**Tags:** authorization\
**Created:** [December 7, 2022, 10:31pm UTC](https://community.postman.com/t/authorization-header-together-with-auth-config/41860 "2022-12-07T22:31:28Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![marolej](https://avatars.discourse-cdn.com/v4/letter/m/73ab20/32.png) [@marolej](https://community.postman.com/u/marolej)\
**Post date:** [December 7, 2022, 10:31pm UTC](https://community.postman.com/t/authorization-header-together-with-auth-config/41860/1 "2022-12-07T22:31:29Z")

</div>

In our network settings, a REST request requires _OAuth Token as a URL parameter_ (as access\_token) and additional _Basic Auth data in Authorization Header_. Postman does not allow setting the _Authorization header_, after configuring OAuth 2.0 (in the Auth section).

Is it possible to change this behavior?

/Marcin

---

<div class="post-metadata">

**Author:** ![michaelderekjones](https://sea2.discourse-cdn.com/getpostman/user_avatar/community.postman.com/michaelderekjones/32/14819_2.png) [@michaelderekjones](https://community.postman.com/u/michaelderekjones)\
**Post date:** [December 8, 2022, 10:49am UTC](https://community.postman.com/t/authorization-header-together-with-auth-config/41860/2 "2022-12-08T10:49:16Z")

</div>

You may need to do this as a pre-request script instead of using the in-built authorization.

It gives you a bit more control over the authentication.

The following is an example of authenticating with Microsoft that you can extend to include the headers that you need. It only gets a new token if it thinks the current one has expired.

```auto
pm.test("Check for collectionVariables", function () {
    let vars = ['clientId', 'clientSecret', 'tenantId', 'username', 'password', 'scope'];
    vars.forEach(function (item, index, array) {
        console.log(item, index);
        pm.expect(pm.collectionVariables.get(item), item + " variable not set").to.not.be.undefined;
        pm.expect(pm.collectionVariables.get(item), item + " variable not set").to.not.be.empty; 
    });

    if (!pm.collectionVariables.get("bearerToken") || Date.now() > new Date(pm.collectionVariables.get("bearerTokenExpiresOn") * 1000)) {
        pm.sendRequest({
            url: 'https://login.microsoftonline.com/' + pm.collectionVariables.get("tenantId") + '/oauth2/v2.0/token',
            method: 'POST',
            header: 'Content-Type: application/x-www-form-urlencoded',
            body: {
                mode: 'urlencoded',
                urlencoded: [
                    { key: "client_id", value: pm.collectionVariables.get("clientId"), disabled: false },
                    { key: "scope", value: pm.collectionVariables.get("scope"), disabled: false },
                    { key: "username", value: pm.collectionVariables.get("username"), disabled: false },
                    { key: "password", value: pm.collectionVariables.get("password"), disabled: false },                    
                    { key: "client_secret", value: pm.collectionVariables.get("clientSecret"), disabled: false },
                    { key: "grant_type", value: "password", disabled: false },
                ]
            }
        }, function (err, res) {
            if (err) {
                console.log(err);
            } else {
                pm.test("Status code is 200", () => {
                    pm.expect(res).to.have.status(200);
                });
                let resJson = res.json();
                pm.collectionVariables.set("bearerTokenExpiresOn", resJson.expires_in);
                pm.collectionVariables.set("bearerToken", resJson.id_token);
            }
        });
    }
});

```