How to add custom headers to the builtin OAuth token request?

[titogarcia (Ernesto Garcia)]

The API I’m invoking requires an “x-api-key” header for the OAuth2 token request. I haven’t found a way to add it to the builtin OAuth2 workflow. (Pre-request scripts don’t work for OAuth2). Is there a way to do this?

[allenheltondev (Allen Helton)]

It seems like the API you are hitting might not be following OAuth 2.0 norms. I don’t think there is a way to add the header to the built-in mechanism, but you can check out this article to add a pre-request script to your collection that will effectively do the same thing. Of course you will have to add the header into the request you are building, but that’s not too bad.

Medium Article: How to Automate OAuth2 Token Renewal in Postman

Hey everyone, I have seen on a number of forums and stack overflow articles people expressing their frustration with the manual process Postman has for renewing OAuth2 tokens when they expire. I thought I would share a write up I did to help you get past the manual process and have your tokens renewing automatically. Let me know what you think!

[titogarcia (Ernesto Garcia)]

Hi Allen, thanks for your response. The API I’m calling is actually built by my own company! Are we breaking the OAuth2 standard by enforcing an x-api-key header on the token request?

[allenheltondev (Allen Helton)]

I am by no means an OAuth2 expert, but it’s not a pattern I’ve seen before.

Typically what you would see when you are requesting your access token is have some sort of auth to the token bearer service through client credentials, implicit grant, or password.

You might want to give this url a once over, OAuth2 has very well established patterns in place.
http://oauthbible.com/

[titogarcia (Ernesto Garcia)]

We require client credentials and all, so we implement OAuth workflows. It’s only that we additionally require the x-api-key header. It would be nice if Postman would allow to customize its builtin OAuth requests.

Thanks

[allenheltondev (Allen Helton)]

Did you follow the guideline in the article I linked? You will be able to add your custom header that way.

[titogarcia (Ernesto Garcia)]

I saw the link. Actually I was asking on behalf of some customer that was using Postman to try out our APIs. I will refer them to your article. I usually prefer to use my own programming language to try out APIs.

[tvvignesh]

Hi. I have this requirement as well. The popular nodejs library (panva) supports this with the use of extraParams parameter: node-oidc-provider/README.md at main · panva/node-oidc-provider · GitHub and Auth0 supports this as well as mentioned here: How to pass custom parameter to a custom OAuth2 connection? - #6 by jmangelo - Auth0 Community and I am using one parameter to help me with multi tenancy in OAuth2 but unable to do it via postman.