How does Postman OAuth2 Login with authorization-code work?

Help Hub
1

I observed that when using the authorization code flow, there is actually no redirection to the callback URL: Postman intercepts the redirection and performs the exchange of the code for tokens itself.

How does this happen?

Does it use a browser without the usual checks on iframe source being SameSite, and listen for src events to intercept the redirection from the authorization server to the callback URL?

2

Hi @Ch4mp :waving_hand:. Welcome to the Postman Community :postman:.

When working with the OAuth Authorization helper in Postman, we use(and recommend you use) a redirect URI provided by Postman. There are two, respectively:

Desktop: https://oauth.pstmn.io/v1/callback
Browser: https://oauth.pstmn.io/v1/browser-callback

This enables Postman to:

  • Get the authorization code for you
  • Redirect you to the Postman Platform after
  • Exchange the authorization code for an access + refresh token pair
  • Auto-refresh the access token if you choose to toggle that option