# Postman workflow 'authorization' header conflict (possible bug) **URL:** \ **Category:** Help Hub\ **Tags:** postman-flows\ **Created:** [January 15, 2026, 11:07am UTC](https://community.postman.com/t/postman-workflow-authorization-header-conflict-possible-bug/88058 "2026-01-15T11:07:37Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![mikhaelian-r](https://avatars.discourse-cdn.com/v4/letter/m/c6cbf5/32.png) [@mikhaelian-r](https://community.postman.com/u/mikhaelian-r)\ **Post date:** [January 15, 2026, 11:07am UTC](https://community.postman.com/t/postman-workflow-authorization-header-conflict-possible-bug/88058/1 "2026-01-15T11:07:37Z")
When I run my workflow locally (hitting the run button) the flow receives defined header in the request ![Screenshot 2026-01-15 at 1.01.37 PM](https://us1.discourse-cdn.com/getpostman/original/3X/4/f/4f13cf46645a9a9a5a470c233707760f36881d24.png) ![Screenshot 2026-01-15 at 1.03.22 PM](https://us1.discourse-cdn.com/getpostman/original/3X/4/7/473b8fa39f085ca41e2e1e7329f33b5179ba58b6.png) But when i deploy the the flow and pass the ‘Authorization’ header to that flow i get the error that doesn’t present in the flow ![Screenshot 2026-01-15 at 1.05.41 PM](https://us1.discourse-cdn.com/getpostman/original/3X/5/4/541f588f9298d320688dec1ac81e8d8acfb1de06.png) If i change my flow to handle ‘x-auth‘ instead of ‘authorization‘ header it works correctly. So there is a problem with conflicting “Authorization” header I don’t want to use any other header, i need to utilize ‘authorization’ header. Is it a bug? ---
**Author:** ![danny-dainton](https://sea2.discourse-cdn.com/getpostman/user_avatar/community.postman.com/danny-dainton/32/29401_2.png) [@danny-dainton](https://community.postman.com/u/danny-dainton)\ **Post date:** [January 20, 2026, 7:24pm UTC](https://community.postman.com/t/postman-workflow-authorization-header-conflict-possible-bug/88058/2 "2026-01-20T19:24:34Z")
Hey @mikhaelian-r 👋🏻 Is this still an issue for you with your flow? Potentially, @lunar-module-1 or @flows-daniel might be able to help here. 🙏🏼 ---
**Author:** ![flows-daniel](https://sea2.discourse-cdn.com/getpostman/user_avatar/community.postman.com/flows-daniel/32/25516_2.png) [@flows-daniel](https://community.postman.com/u/flows-daniel)\ **Post date:** [January 20, 2026, 8:12pm UTC](https://community.postman.com/t/postman-workflow-authorization-header-conflict-possible-bug/88058/3 "2026-01-20T20:12:46Z")
Hi @mikhaelian-r I’m curious why you need to use the authorization keyword specifically like this? When sending that keyword we expect something like bearer or basic to determine the schema. You are correct that in the scenario we don’t enforce this vs the actual server call once it’s deployed. Will file an improvement for this. ---
**Author:** ![mikhaelian-r](https://avatars.discourse-cdn.com/v4/letter/m/c6cbf5/32.png) [@mikhaelian-r](https://community.postman.com/u/mikhaelian-r)\ **Post date:** [January 21, 2026, 7:49am UTC](https://community.postman.com/t/postman-workflow-authorization-header-conflict-possible-bug/88058/4 "2026-01-21T07:49:56Z")
Hey Im working on providing integration for clients of our company and we needed to provide some tools to our clients which they will use in order to test their integration with us. One of the step of the integration is they should send a “callback“ http request and on our side we should check if the signature which they pass in the authorization header is correct. I found that postman flow are perfect match for that job, it can receive request and then check with crypto algorithm to check if the signature is correct and return 200 or 401. But unfortunately when I deploy this flow the authorization header is reserved and cannot be used. I couldn’t find a solution to use postman mock servers in order to check signature so I used the postman flows ---
**Author:** ![lunar-module-1](https://sea2.discourse-cdn.com/getpostman/user_avatar/community.postman.com/lunar-module-1/32/26132_2.png) [@lunar-module-1](https://community.postman.com/u/lunar-module-1)\ **Post date:** [January 21, 2026, 8:16am UTC](https://community.postman.com/t/postman-workflow-authorization-header-conflict-possible-bug/88058/5 "2026-01-21T08:16:38Z")
When you make the request can you share the actual headers sent? Will try to replicate and explore a fix in flows. ---
**Author:** ![mikhaelian-r](https://avatars.discourse-cdn.com/v4/letter/m/c6cbf5/32.png) [@mikhaelian-r](https://community.postman.com/u/mikhaelian-r)\ **Post date:** [January 21, 2026, 8:35am UTC](https://community.postman.com/t/postman-workflow-authorization-header-conflict-possible-bug/88058/6 "2026-01-21T08:35:48Z")
sure, here is the screenshot from the postman interface ![Screenshot 2026-01-21 at 10.32.13 AM](https://us1.discourse-cdn.com/getpostman/original/3X/7/c/7c13fb13734f27ab9c8508055df7002ad8ffdff8.png) ---
**Author:** ![lunar-module-1](https://sea2.discourse-cdn.com/getpostman/user_avatar/community.postman.com/lunar-module-1/32/26132_2.png) [@lunar-module-1](https://community.postman.com/u/lunar-module-1)\ **Post date:** [January 21, 2026, 8:48am UTC](https://community.postman.com/t/postman-workflow-authorization-header-conflict-possible-bug/88058/7 "2026-01-21T08:48:38Z")
Can you open the postman console and share the request headers going out and coming back. This error doesn’t look like it’s coming from flows, so trying to figure out how to replicate. If you prefer you can dm me or open a support ticket if there’s sensitive info in the headers you don’t want to post here. We’ll figure this out. ---
**Author:** ![mikhaelian-r](https://avatars.discourse-cdn.com/v4/letter/m/c6cbf5/32.png) [@mikhaelian-r](https://community.postman.com/u/mikhaelian-r)\ **Post date:** [January 21, 2026, 9:05am UTC](https://community.postman.com/t/postman-workflow-authorization-header-conflict-possible-bug/88058/8 "2026-01-21T09:05:19Z")
Sorry, didn’t get what you meant. Here is the log from the console ```auto POST /api/default/callback HTTP/1.1 authorization: d290d739e22d2f050c096b991349e2df2aacf19429ff17cfbeeb321c351a4da5c9f9f402bf048e92fe921f92de23fa53bdf98ce3dd446791bb0242514bbc36fa User-Agent: PostmanRuntime/7.51.0 Accept: */* Postman-Token: 7f101fd3-4884-4bbc-8488-35a60d5ff572 Host: dev-reaction-sprocket.flows.pstmn.io Accept-Encoding: gzip, deflate, br Connection: keep-alive Content-Length: 0 HTTP/1.1 401 Unauthorized Date: Wed, 21 Jan 2026 09:00:16 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 36 Connection: keep-alive CF-RAY: 9c159ec7cbd40b96-MRS vary: Origin x-content-type-options: nosniff x-envoy-upstream-service-time: 5 cf-cache-status: DYNAMIC Set-Cookie: __cf_bm=cRZkB9QrszNQv82QFEOo.b2SXRRTbCwrm8gp1AY4o4w-1768986016-1.0.1.1-p3T2BhOueeyYOU4XjT5nVtdNr4u.RWFlsZuUT264GqK_Iwnx1azsqNmEIAQi22nI10Dqu.AJ1akYM9ZX2CArSc1Se8nb9SyyNpSiJRfdEk4; path=/; expires=Wed, 21-Jan-26 09:30:16 GMT; domain=.pstmn.io; HttpOnly; Secure; SameSite=None Server: cloudflare invalid authorization header format ``` ---
**Author:** ![lunar-module-1](https://sea2.discourse-cdn.com/getpostman/user_avatar/community.postman.com/lunar-module-1/32/26132_2.png) [@lunar-module-1](https://community.postman.com/u/lunar-module-1)\ **Post date:** [January 21, 2026, 2:16pm UTC](https://community.postman.com/t/postman-workflow-authorization-header-conflict-possible-bug/88058/10 "2026-01-21T14:16:11Z")
OK, I understand what’s happening here. The invocation service strictly enforces that the `Authorization` headers for flows deployed to the cloud are bearer tokens as was already pointed out. (You can turn this feature on per flow in the deploy popover.) The intention here is that this the token provided by the system to authenticate the request before running the flow. The confusion for me arose because the error is reported in a non-standard way from this service and so I initially thought something else was a miss (we will correct the error reporting). You’re using the same header and performing your own authentication in the flow. There are three options: the first you already explored, and it involves using a different header key. The other is for us to shift the built-in authorization to a special header and leave the `Authorization` header for user land. The latter will require a bit of coordination so it will not be an easy change to roll out (could break existing flows). The third is to check if the flow has authorization enabled, and only extract the header when it is. This would allow the header to pass through for cases where the flow opts to perform its own auth. Will consider this some more but hopefully this explanation is helpful to you in terms of why it isn’t working as you expect (it’s not a bug, it’s working as intended). ---
**Author:** ![lunar-module-1](https://sea2.discourse-cdn.com/getpostman/user_avatar/community.postman.com/lunar-module-1/32/26132_2.png) [@lunar-module-1](https://community.postman.com/u/lunar-module-1)\ **Post date:** [January 21, 2026, 11:17pm UTC](https://community.postman.com/t/postman-workflow-authorization-header-conflict-possible-bug/88058/11 "2026-01-21T23:17:44Z")
Can you add the word `Bearer` ahead of your API key (eg `Bearer abc123`)? if so, that would pass the check that’s currently in place and you can do the verification after you strip Bearer in the eval bloc. ---
**Author:** ![mikhaelian-r](https://avatars.discourse-cdn.com/v4/letter/m/c6cbf5/32.png) [@mikhaelian-r](https://community.postman.com/u/mikhaelian-r)\ **Post date:** [January 22, 2026, 8:01am UTC](https://community.postman.com/t/postman-workflow-authorization-header-conflict-possible-bug/88058/12 "2026-01-22T08:01:43Z")
Yes, added the `Bearer` prefix. It’s working now, but it slightly different from what I wanted to achieve ---
**Author:** ![lunar-module-1](https://sea2.discourse-cdn.com/getpostman/user_avatar/community.postman.com/lunar-module-1/32/26132_2.png) [@lunar-module-1](https://community.postman.com/u/lunar-module-1)\ **Post date:** [January 22, 2026, 3:53pm UTC](https://community.postman.com/t/postman-workflow-authorization-header-conflict-possible-bug/88058/13 "2026-01-22T15:53:46Z")
OK found a solution that I think works. ![Screenshot 2026-01-22 at 10.49.09 AM](https://us1.discourse-cdn.com/getpostman/original/3X/6/5/656311bb809d355fb1862ace9db80c095013b706.png) ---
**Author:** ![mikhaelian-r](https://avatars.discourse-cdn.com/v4/letter/m/c6cbf5/32.png) [@mikhaelian-r](https://community.postman.com/u/mikhaelian-r)\ **Post date:** [January 23, 2026, 7:57am UTC](https://community.postman.com/t/postman-workflow-authorization-header-conflict-possible-bug/88058/14 "2026-01-23T07:57:19Z")
Nice I was doing the same thing last week, but it wasn’t working. Today suddenly it works without a “Bearer” prefix 🤨 Thank you anyway ---
**Author:** ![lunar-module-1](https://sea2.discourse-cdn.com/getpostman/user_avatar/community.postman.com/lunar-module-1/32/26132_2.png) [@lunar-module-1](https://community.postman.com/u/lunar-module-1)\ **Post date:** [January 23, 2026, 8:16am UTC](https://community.postman.com/t/postman-workflow-authorization-header-conflict-possible-bug/88058/15 "2026-01-23T08:16:01Z")
we rolled this update to production last night to make it work for you 🙂 thanks for the feedback.