# How do you mock authorization flows for an API?

**URL:** <https://community.postman.com/t/how-do-you-mock-authorization-flows-for-an-api/7799>\
**Category:** Help Hub\
**Tags:** mocks, authentication\
**Created:** [September 14, 2019, 12:07am UTC](https://community.postman.com/t/how-do-you-mock-authorization-flows-for-an-api/7799 "2019-09-14T00:07:50Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![kaustavdm](https://sea2.discourse-cdn.com/getpostman/user_avatar/community.postman.com/kaustavdm/32/1778_2.png) [@kaustavdm](https://community.postman.com/u/kaustavdm)\
**Post date:** [September 14, 2019, 12:07am UTC](https://community.postman.com/t/how-do-you-mock-authorization-flows-for-an-api/7799/1 "2019-09-14T00:07:50Z")

</div>

I’m curious to find out how people create API mocks for authentication and authorization flows, either using Postman Mock Servers or any other tool.

For example, let’s say my API endpoints use OAuth 2.0. How would you recommend I create a mock to simulate those flows?

---

<div class="post-metadata">

**Author:** ![Palmju](https://sea2.discourse-cdn.com/getpostman/user_avatar/community.postman.com/palmju/32/2857_2.png) [@Palmju](https://community.postman.com/u/Palmju)\
**Post date:** [September 19, 2019, 2:35pm UTC](https://community.postman.com/t/how-do-you-mock-authorization-flows-for-an-api/7799/2 "2019-09-19T14:35:52Z")

</div>

Hi @kaustavdm,

I used the postman interceptor to catch the authentication/authorization request. After it got logged into my history I saved it within the mock collection i am using. There I clicked ‘Send’ to retrieve a response body (in my case a bearer token), saved the response body as an example, set the unique url/path for that request and set the {{url}} so it would direct the request to my mock the next time i will send it.

I hope this helps you!

---

<div class="post-metadata">

**Author:** ![kaustavdm](https://sea2.discourse-cdn.com/getpostman/user_avatar/community.postman.com/kaustavdm/32/1778_2.png) [@kaustavdm](https://community.postman.com/u/kaustavdm)\
**Post date:** [September 19, 2019, 8:08pm UTC](https://community.postman.com/t/how-do-you-mock-authorization-flows-for-an-api/7799/3 "2019-09-19T20:08:24Z")

</div>

@Palmju This is a very impressive workflow! What was your use case?

---

<div class="post-metadata">

**Author:** ![Palmju](https://sea2.discourse-cdn.com/getpostman/user_avatar/community.postman.com/palmju/32/2857_2.png) [@Palmju](https://community.postman.com/u/Palmju)\
**Post date:** [September 20, 2019, 1:42pm UTC](https://community.postman.com/t/how-do-you-mock-authorization-flows-for-an-api/7799/4 "2019-09-20T13:42:22Z")

</div>

I am doing end-to-end testing for a customer. In order to test their services without dependencies I have chosen to use postman to create mockservers so I can replace Api’s. That way I can preform behaviour driven development within their goal/requirements without being disturbed by changing data.