# Browser-based PKCE auth token automation doesn't work with MS AAD **URL:** \ **Category:** Help Hub\ **Tags:** authentication\ **Created:** [February 16, 2023, 6:42pm UTC](https://community.postman.com/t/browser-based-pkce-auth-token-automation-doesnt-work-with-ms-aad/44085 "2023-02-16T18:42:22Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![joshkslalom](https://avatars.discourse-cdn.com/v4/letter/j/bbce88/32.png) [@joshkslalom](https://community.postman.com/u/joshkslalom)\ **Post date:** [February 16, 2023, 6:42pm UTC](https://community.postman.com/t/browser-based-pkce-auth-token-automation-doesnt-work-with-ms-aad/44085/1 "2023-02-16T18:42:22Z")
Microsoft’s AAD supports PKCE auth through the use of a ‘Single Page Application’ on an application registration. When requesting a token, AAD expects to see an Origin header in the request and rejects it if not found. Because there is no way to manipulate the request sent via the launched browser, PKCE auth fails with AAD. is there a workaround for this or is a fix on the way? ---
**Author:** ![michaelderekjones](https://sea2.discourse-cdn.com/getpostman/user_avatar/community.postman.com/michaelderekjones/32/14819_2.png) [@michaelderekjones](https://community.postman.com/u/michaelderekjones)\ **Post date:** [February 17, 2023, 11:03am UTC](https://community.postman.com/t/browser-based-pkce-auth-token-automation-doesnt-work-with-ms-aad/44085/2 "2023-02-17T11:03:20Z")
Are you using the desktop client or the web client? If using the web client, you need the Postman desktop agent to support the CORS element which this relates to. ---
**Author:** ![michaelderekjones](https://sea2.discourse-cdn.com/getpostman/user_avatar/community.postman.com/michaelderekjones/32/14819_2.png) [@michaelderekjones](https://community.postman.com/u/michaelderekjones)\ **Post date:** [February 17, 2023, 11:11am UTC](https://community.postman.com/t/browser-based-pkce-auth-token-automation-doesnt-work-with-ms-aad/44085/3 "2023-02-17T11:11:13Z")
Actually saying that, not sure if the built in authentication supports this yet. [Add `Origin` header to OAuth 2.0 flow - Help - Postman](https://community.postman.com/t/add-origin-header-to-oauth-2-0-flow/39402) Therefore you may have to use sendRequest in a pre-request script to generate your token instead where you should be in full control of what headers you send. Or you could craft a Post request with all of the settings. I prefer the pre-request script as you can handle the token expires with simple IF statements. ---
**Author:** ![joshkslalom](https://avatars.discourse-cdn.com/v4/letter/j/bbce88/32.png) [@joshkslalom](https://community.postman.com/u/joshkslalom)\ **Post date:** [February 17, 2023, 7:54pm UTC](https://community.postman.com/t/browser-based-pkce-auth-token-automation-doesnt-work-with-ms-aad/44085/4 "2023-02-17T19:54:56Z")
PKCE is a client-based flow which involves the use of a browser and redirects. Can’t fake it through pre and post request scripts