# Oauth2 Password Credential doesn't work but a simple request with the same body does

**URL:** <https://community.postman.com/t/oauth2-password-credential-doesnt-work-but-a-simple-request-with-the-same-body-does/34841>\
**Category:** Help Hub\
**Tags:** authentication\
**Created:** [April 28, 2022, 10:17am UTC](https://community.postman.com/t/oauth2-password-credential-doesnt-work-but-a-simple-request-with-the-same-body-does/34841 "2022-04-28T10:17:52Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![docking-module-phys4](https://sea2.discourse-cdn.com/getpostman/user_avatar/community.postman.com/docking-module-phys4/32/11840_2.png) [@docking-module-phys4](https://community.postman.com/u/docking-module-phys4)\
**Post date:** [April 28, 2022, 10:17am UTC](https://community.postman.com/t/oauth2-password-credential-doesnt-work-but-a-simple-request-with-the-same-body-does/34841/1 "2022-04-28T10:17:52Z")

</div>

Hi,  
I am trying to set the authentication method for a collection. The method is Oauth2 with Password credentials. I am able to get the token with a simple request, but not when try to set the collection’s authentication.

Here’s the log with error:

```auto
POST /api/externalServices/login HTTP/1.1
Content-Type: application/x-www-form-urlencoded
User-Agent: PostmanRuntime/7.29.0
Accept: */*
Cache-Control: no-cache
Postman-Token: 8302e858-113e-489a-a477-fa4336e99c77
Host: api.retelogisticastorage.it
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Content-Length: 87
 
grant_type=password&username=xxxxxx&password=xxxxxx&client_id=&client_secret=
 
HTTP/1.1 415 Unsupported Media Type
Server: nginx
Date: Thu, 28 Apr 2022 10:09:36 GMT
Content-Length: 0

```

Here is the log of the simple request:

```auto
POST /api/externalServices/login HTTP/1.1
Content-Type: application/json
User-Agent: PostmanRuntime/7.29.0
Accept: */*
Postman-Token: 52497d11-be4c-4edd-ac9c-cbef2dd81304
Host: api.retelogisticastorage.it
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Content-Length: 128
 
{
grant_type: "password",
username: "xxxxxx",
password: "xxxxxx",
client_id: "",
client_secret: ""
}
 
HTTP/1.1 200 OK
Transfer-Encoding: chunked
Content-Type: application/json; charset=utf-8
Content-Encoding: br
Server: nginx
X-Powered-By: PleskLin
Date: Thu, 28 Apr 2022 10:14:14 GMT
 
{
"authToken": "<omissis>",
"username": "Riparaora"
}

```

It appears to me that the credentials are sent as query string instead of body, although I selected the “Send client credential in body” as option. See attachment.

 ![2022-04-28_12-16-21](https://us1.discourse-cdn.com/getpostman/original/2X/4/45a439c3f7a1ae6832be2bfd7fba64e7ad5019a5.jpeg)

Am I doing something wrong?

To be noted: url, username and password use the same variables.

---

<div class="post-metadata">

**Author:** ![w4dd325](https://sea2.discourse-cdn.com/getpostman/user_avatar/community.postman.com/w4dd325/32/12436_2.png) [@w4dd325](https://community.postman.com/u/w4dd325)\
**Post date:** [April 28, 2022, 4:48pm UTC](https://community.postman.com/t/oauth2-password-credential-doesnt-work-but-a-simple-request-with-the-same-body-does/34841/2 "2022-04-28T16:48:25Z")

</div>

Hi @docking-module-phys4

[This link](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/415) on _ **415 Unsupported Media Type** _ errors (as seen in your info above) suggest that the payload is wrong.

It suggests checking the [`Content-Type`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Type) or [`Content-Encoding`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Encoding).

Try checking your output to ensure that the payload looks like it is supposed to.

---

<div class="post-metadata">

**Author:** ![docking-module-phys4](https://sea2.discourse-cdn.com/getpostman/user_avatar/community.postman.com/docking-module-phys4/32/11840_2.png) [@docking-module-phys4](https://community.postman.com/u/docking-module-phys4)\
**Post date:** [April 29, 2022, 6:17am UTC](https://community.postman.com/t/oauth2-password-credential-doesnt-work-but-a-simple-request-with-the-same-body-does/34841/3 "2022-04-29T06:17:29Z")

</div>

That could be it, but how could I change the `Content-Type` or `Content-Encoding` in authorization requests?  
I don’t see any option to edit the headers in auth requests.

---

<div class="post-metadata">

**Author:** ![w4dd325](https://sea2.discourse-cdn.com/getpostman/user_avatar/community.postman.com/w4dd325/32/12436_2.png) [@w4dd325](https://community.postman.com/u/w4dd325)\
**Post date:** [April 29, 2022, 9:21am UTC](https://community.postman.com/t/oauth2-password-credential-doesnt-work-but-a-simple-request-with-the-same-body-does/34841/4 "2022-04-29T09:21:40Z")

</div>

Add the header yourself. If you start typing the words in the _key:value_ boxes it will give you a list to choose from.

 ![image](https://us1.discourse-cdn.com/getpostman/original/3X/f/9/f9fc4eb1f37d108e3b43ef31e72255c27c7261a9.png)

The auth headers would also be added to this list, they all get sent together.

---

<div class="post-metadata">

**Author:** ![docking-module-phys4](https://sea2.discourse-cdn.com/getpostman/user_avatar/community.postman.com/docking-module-phys4/32/11840_2.png) [@docking-module-phys4](https://community.postman.com/u/docking-module-phys4)\
**Post date:** [April 29, 2022, 9:50am UTC](https://community.postman.com/t/oauth2-password-credential-doesnt-work-but-a-simple-request-with-the-same-body-does/34841/5 "2022-04-29T09:50:27Z")

</div>

There is no headers option when editing the authentication method for a collection, that is why I’m confused…

 ![2022-04-29_11-49-26](https://us1.discourse-cdn.com/getpostman/original/2X/2/27332ed3d86be5478702851694e096b8718be429.jpeg)

---

<div class="post-metadata">

**Author:** ![w4dd325](https://sea2.discourse-cdn.com/getpostman/user_avatar/community.postman.com/w4dd325/32/12436_2.png) [@w4dd325](https://community.postman.com/u/w4dd325)\
**Post date:** [April 29, 2022, 10:19am UTC](https://community.postman.com/t/oauth2-password-credential-doesnt-work-but-a-simple-request-with-the-same-body-does/34841/6 "2022-04-29T10:19:49Z")

</div>

That’s at the _ **collection** _ level, I’m at _ **request** _ level.

---

<div class="post-metadata">

**Author:** ![docking-module-phys4](https://sea2.discourse-cdn.com/getpostman/user_avatar/community.postman.com/docking-module-phys4/32/11840_2.png) [@docking-module-phys4](https://community.postman.com/u/docking-module-phys4)\
**Post date:** [April 29, 2022, 10:49am UTC](https://community.postman.com/t/oauth2-password-credential-doesnt-work-but-a-simple-request-with-the-same-body-does/34841/7 "2022-04-29T10:49:14Z")

</div>

Maybe I didn’t make myself clear in the first post: I am trying to set a collection Authorization.

For the sake of trying, I used your suggestion at request level, and I still got the same problem. I noticed also that the custom headers are not used in the authentication request.

Here a screenshot of my headers, notice the `Content-Type`:

 ![2022-04-29_12-43-11](https://us1.discourse-cdn.com/getpostman/original/2X/0/0093ee509a335ed43a3f76cd1c8b1a131574503d.jpeg)

Here’s the log of the error I got when asking for new token:

```auto
POST https://api.retelogisticastorage.it/api/externalServices/login: {
  "Network": {
    "addresses": {
      "local": {
        "address": "10.5.49.214",
        "family": "IPv4",
        "port": 54206
      },
      "remote": {
        "address": "51.144.66.35",
        "family": "IPv4",
        "port": 443
      }
    },
    "tls": {
      "reused": false,
      "authorized": true,
      "authorizationError": null,
      "cipher": {
        "name": "ECDHE-RSA-AES256-GCM-SHA384",
        "standardName": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
        "version": "TLSv1/SSLv3"
      },
      "protocol": "TLSv1.2",
      "ephemeralKeyInfo": {},
      "peerCertificate": {
        "subject": {
          "commonName": "*.retelogisticastorage.it",
          "alternativeNames": "DNS:*.retelogisticastorage.it, DNS:retelogisticastorage.it"
        },
        "issuer": {
          "country": "GB",
          "stateOrProvince": "Greater Manchester",
          "locality": "Salford",
          "organization": "Sectigo Limited",
          "commonName": "Sectigo RSA Domain Validation Secure Server CA"
        },
        "validFrom": "Mar 21 00:00:00 2022 GMT",
        "validTo": "Mar 21 23:59:59 2023 GMT",
        "fingerprint": "58:30:8C:CE:DB:AC:63:32:F3:C8:8A:6F:23:CF:23:35:B4:6F:C8:ED",
        "serialNumber": "0bdf4d03b3782d260db02d124174795b"
      }
    }
  },
  "Request Headers": {
    "content-type": "application/x-www-form-urlencoded",
    "user-agent": "PostmanRuntime/7.29.0",
    "accept": "*/*",
    "cache-control": "no-cache",
    "postman-token": "7f4caaa8-e4dd-4360-bb30-42a5e56da744",
    "host": "api.retelogisticastorage.it",
    "accept-encoding": "gzip, deflate, br",
    "connection": "keep-alive",
    "content-length": "77"
  },
  "Request Body": {
    "grant_type": "client_credentials",
    "client_id": "xxxxx",
    "client_secret": "xxxxx"
  },
  "Response Headers": {
    "server": "nginx",
    "date": "Fri, 29 Apr 2022 10:43:37 GMT",
    "content-length": "0"
  }
}
Error: Could not complete OAuth 2.0 token request

```

It appears that the header’s field I added is not used.

I am able to create a simple request to obtain a token, but I would like to obtain the token, but I am trying to achieve is to automate the oauth2 request for every request in the collection, that’s why I was working on collection level.