# Real noob question: how to get a bearer token?

**URL:** <https://community.postman.com/t/real-noob-question-how-to-get-a-bearer-token/29709>\
**Category:** Help Hub\
**Tags:** bearer-token\
**Created:** [November 15, 2021, 9:48am UTC](https://community.postman.com/t/real-noob-question-how-to-get-a-bearer-token/29709 "2021-11-15T09:48:46Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![orisack](https://avatars.discourse-cdn.com/v4/letter/o/eb8c5e/32.png) [@orisack](https://community.postman.com/u/orisack)\
**Post date:** [November 15, 2021, 9:48am UTC](https://community.postman.com/t/real-noob-question-how-to-get-a-bearer-token/29709/1 "2021-11-15T09:48:46Z")

</div>

I don’t know how to get the bearer token… I’m starting today to learn about APIs. I wanted to test the free banking APIs at [nordigen.com](http://nordigen.com), and tried following the guide over there.  
I have setup a collection and an API here in Postman. Then following the [nordigen.com](http://nordigen.com) guide I chose _Bearer token_ in Postman as authorization type, but now, I have to put the token value in the Token box, and… I don’t know how to get it.  
At nordigen, they say to “Under Authorization, change the authorization value from `true` to `Bearer YOUR_TOKEN`”

And they indicate that, to get the token, I should  
“get your user secret from [Nordigen’s Open Banking Portal] in section User Secrets.”  
This I have done correctly (I think).  
Afterwards I should “Use those secrets to create an access token (referenced as ACCESS\_TOKEN in the following steps).”  
They indicate to run this code:

```auto
curl -X POST "https://ob.nordigen.com/api/v2/token/new/" 
-H "accept: application/json" 
-H "Content-Type: application/json" 
-d "{
     \"secret_id\":\"string\",
     \"secret_key\":\"string\"}"

```

which I do and I get the following response:

```auto
{
  "access": "string",
  "access_expires": 86400,
  "refresh": "string",
  "refresh_expires": 2592000
}

```

Which I guess some part of it is the token I have to introduce in the Token box in Postman, but what part?  
I have tried to introduce the string after _“access”_, also the entire snippet, but it doesn’t seem to work.

Real noob here, thanks for helping…

---

<div class="post-metadata">

**Author:** ![danny-dainton](https://sea2.discourse-cdn.com/getpostman/user_avatar/community.postman.com/danny-dainton/32/29401_2.png) [@danny-dainton](https://community.postman.com/u/danny-dainton)\
**Post date:** [November 15, 2021, 10:04am UTC](https://community.postman.com/t/real-noob-question-how-to-get-a-bearer-token/29709/2 "2021-11-15T10:04:59Z")

</div>

Just taking an example from their documentation, you would need to manually add a new header called `Authorization` and then add `Bearer <token>` as the value.

```auto
curl -X GET "https://ob.nordigen.com/api/v2/institutions/?country=gb" 
-H "accept: application/json" 
-H "Authorization: Bearer ACCESS_TOKEN"

```

You can use use the `Bearer Token` helper in the _Authorization_ tab of the request, this will auto-create the header once you add the value.

 ![image](https://us1.discourse-cdn.com/getpostman/original/3X/3/a/3a38164bffb2762904d3a88c584a06de8c291d22.png)

 ![image](https://us1.discourse-cdn.com/getpostman/original/3X/6/4/6477743f56a5be770389e5ee805e3f69861968a3.png)

---

<div class="post-metadata">

**Author:** ![orisack](https://avatars.discourse-cdn.com/v4/letter/o/eb8c5e/32.png) [@orisack](https://community.postman.com/u/orisack)\
**Post date:** [November 15, 2021, 10:19am UTC](https://community.postman.com/t/real-noob-question-how-to-get-a-bearer-token/29709/3 "2021-11-15T10:19:32Z")

</div>

Thanks for your answer.  
I was trying to introduce the token here:

 ![image](https://us1.discourse-cdn.com/getpostman/original/3X/6/4/64f4e2207fa97d2d3948a6fa74d9453e767d9191.png)

But following your answer I guess I should introduce the snippet here instead, right?

 ![image](https://us1.discourse-cdn.com/getpostman/original/3X/a/e/ae7281690cb2b385a7658827dca45a0b4d056943.png)

If this is the correct place, I’m still a bit confused because the _POST JWT Obtain_ states it will inherit from parent (parent being _Nordigen Account Information Services API_ - that’s why I tried to introduce the value there):

 ![image](https://us1.discourse-cdn.com/getpostman/original/3X/a/7/a7403a6d9f13f9763b0f00f9bf4be7fec107a635.png)

---

<div class="post-metadata">

**Author:** ![danny-dainton](https://sea2.discourse-cdn.com/getpostman/user_avatar/community.postman.com/danny-dainton/32/29401_2.png) [@danny-dainton](https://community.postman.com/u/danny-dainton)\
**Post date:** [November 15, 2021, 11:01am UTC](https://community.postman.com/t/real-noob-question-how-to-get-a-bearer-token/29709/4 "2021-11-15T11:01:54Z")

</div>

The first call would be made to get the token, once you have the token value from the response, you would use that in the header for the other requests made to that API.

The _examples_ under your requests (the ones you have in the images) are used for Mock Server responses and for documentation.

---

<div class="post-metadata">

**Author:** ![orisack](https://avatars.discourse-cdn.com/v4/letter/o/eb8c5e/32.png) [@orisack](https://community.postman.com/u/orisack)\
**Post date:** [November 15, 2021, 11:12am UTC](https://community.postman.com/t/real-noob-question-how-to-get-a-bearer-token/29709/5 "2021-11-15T11:12:20Z")

</div>

I still don’t understand what I have to do, thanks for trying to explain though 🙂  
I’m going to do the Postman tutorial, then I’ll try again.

---

<div class="post-metadata">

**Author:** ![danny-dainton](https://sea2.discourse-cdn.com/getpostman/user_avatar/community.postman.com/danny-dainton/32/29401_2.png) [@danny-dainton](https://community.postman.com/u/danny-dainton)\
**Post date:** [November 15, 2021, 1:11pm UTC](https://community.postman.com/t/real-noob-question-how-to-get-a-bearer-token/29709/6 "2021-11-15T13:11:35Z")

</div>

The Collection you have isn’t really in the right order, to be honest, as you would need a token first, to authenticate yourself against the other endpoints of the API.

From the Quickstart guide:

> **[Bank Account Data](https://gocardless.com/bank-account-data/)**

The first thing you do is make a POST request to the `https://ob.nordigen.com/api/v2/token/new/` with the secret values that you have most likely got from creating an account with that service.

> First, you’ll need to get your user secret from [Nordigen’s Open Banking Portal](https://ob.nordigen.com/user-secrets/) in section User Secrets. Use those secrets to create an access token (referenced as ACCESS\_TOKEN in the following steps).

 ![image](https://us1.discourse-cdn.com/getpostman/original/3X/9/e/9e6547e953fcf424cf33936757b2654526e1f227.png)

The response of this is going to be the token information that you will use to make a request to a different endpoint.

```auto
{
  "access": "someSecretValue",
  "access_expires": 86400,
  "refresh": "someRefreshSecretValue",
  "refresh_expires": 2592000
}

```

 ![image](https://us1.discourse-cdn.com/getpostman/original/3X/d/b/dbd384307b494a50abfa8646b18ef6036e79933b.png)

In this example from the Quickstart guide, the `ACCESS_TOKEN` value, is the same value as the `token` value from the response of the first request. This has an expiry time (I think it’s 24 Hours) so once that’s run out, you will need to request a fresh token and reset the clock.

There are different methods of automatically extracting the response values into a variable and using that in the headers, I would initially get this working by hardcoding the values first and then refactoring what you have.

* * *

Once you’re ready, you can get the token by adding this to the `Tests` section of the token request:

```auto
pm.globals.set('token', pm.resonse.json().token);

```

 ![image](https://us1.discourse-cdn.com/getpostman/original/3X/d/d/dd0286aa6a241d638414790c4fdea91b70982292.png)

You will then be able to use the variable syntax to replace the header values:

 ![image](https://us1.discourse-cdn.com/getpostman/original/3X/3/9/3985a5008f633468229804044961b30f40d1af10.png)

---

<div class="post-metadata">

**Author:** ![orisack](https://avatars.discourse-cdn.com/v4/letter/o/eb8c5e/32.png) [@orisack](https://community.postman.com/u/orisack)\
**Post date:** [November 15, 2021, 1:58pm UTC](https://community.postman.com/t/real-noob-question-how-to-get-a-bearer-token/29709/7 "2021-11-15T13:58:19Z")

</div>

Thx for your patience.  
This part is clear and I did it already:

> [@danny-dainton](#):
>
> The response of this is going to be the token information that you will use to make a request to a different endpoint.
> 
> ```auto
> {
> "access": "someSecretValue",
> "access_expires": 86400,
> "refresh": "someRefreshSecretValue",
> "refresh_expires": 2592000
> }
> 
> ```

What I don’t know is **what** do I put next in what seems the correct place to put it in, ie.:

 ![image](https://us1.discourse-cdn.com/getpostman/original/3X/8/7/87e70286ac3ac0542fa26298def1bde31e013368.png)

Is it the entire above snippet, the “access” value, any other value?

---

<div class="post-metadata">

**Author:** ![danny-dainton](https://sea2.discourse-cdn.com/getpostman/user_avatar/community.postman.com/danny-dainton/32/29401_2.png) [@danny-dainton](https://community.postman.com/u/danny-dainton)\
**Post date:** [November 15, 2021, 2:17pm UTC](https://community.postman.com/t/real-noob-question-how-to-get-a-bearer-token/29709/8 "2021-11-15T14:17:19Z")

</div>

An object is returned from that response with a bunch of keys (`access`, `access_expires`, `refresh` and `refresh_expires`) each _key_ has a _value_.

Your `token` is the _value_ of the `access` _key_.

 ![image](https://us1.discourse-cdn.com/getpostman/original/3X/d/4/d40c12d51ab0596c33b4aaf8e7cdbed27ccfb7a1.png)

---

<div class="post-metadata">

**Author:** ![orisack](https://avatars.discourse-cdn.com/v4/letter/o/eb8c5e/32.png) [@orisack](https://community.postman.com/u/orisack)\
**Post date:** [November 15, 2021, 3:36pm UTC](https://community.postman.com/t/real-noob-question-how-to-get-a-bearer-token/29709/9 "2021-11-15T15:36:56Z")

</div>

Very helpful, thanks a lot for your help. I’ll keep on with the nordigen tutorial now.