# \#oauth2 **URL:** https://community.postman.com/tag/oauth2/86.md [Latest](https://community.postman.com/latest.md) · [Categories](https://community.postman.com/categories.md) · [Tags](https://community.postman.com/tags.md) --- ## [OAuth 2.0 rotate refresh token](https://community.postman.com/t/oauth-2-0-rotate-refresh-token/86195)
**Author:** [@ugofoscolo](https://community.postman.com/u/ugofoscolo)\ **Replies:** 3\ **Last updated:** [October 24, 2025, 1:07pm UTC](https://community.postman.com/t/oauth-2-0-rotate-refresh-token/86195 "2025-10-24T13:07:01Z")
I configured oauth 2.0 such that access token is refreshed properly, but when calling the “Refresh Roken URL“, a new refresh\_token is passed aswell. How does postman properly deal with refresh\_token rotation? --- ## [How to automatically set OAuth 2.0 Access Token as variable](https://community.postman.com/t/how-to-automatically-set-oauth-2-0-access-token-as-variable/32295)
**Author:** [@mrabetr](https://community.postman.com/u/mrabetr)\ **Replies:** 12\ **Last updated:** [September 5, 2025, 8:45am UTC](https://community.postman.com/t/how-to-automatically-set-oauth-2-0-access-token-as-variable/32295 "2025-09-05T08:45:21Z")
I have set up OAuth 2.0 Authorization with Authorization Code flow (i.e. user needs to authenticate) for a collection and i would like to automatically set the response, which includes access token, refresh token and oth… --- ## [Postman OAuth 2 missing parameter "code" with OpenID Connect](https://community.postman.com/t/postman-oauth-2-missing-parameter-code-with-openid-connect/70274)
**Author:** [@alex.tran](https://community.postman.com/u/alex.tran)\ **Replies:** 5\ **Last updated:** [August 20, 2025, 2:41pm UTC](https://community.postman.com/t/postman-oauth-2-missing-parameter-code-with-openid-connect/70274 "2025-08-20T14:41:13Z")
Hi all, I’m using OpenID Connect (Keycloak, Okta) for authentication and configure Postman to obtain the access token via OAuth 2.0 for testing. My Postman OAuth 2 configuration is in the following screenshot: Postm… --- ## [Postman desktop client 11.58.5 broke oauth2 authorization redirect - completely broken](https://community.postman.com/t/postman-desktop-client-11-58-5-broke-oauth2-authorization-redirect-completely-broken/83658)
**Author:** [@martin2176](https://community.postman.com/u/martin2176)\ **Replies:** 5\ **Last updated:** [August 19, 2025, 11:18am UTC](https://community.postman.com/t/postman-desktop-client-11-58-5-broke-oauth2-authorization-redirect-completely-broken/83658 "2025-08-19T11:18:50Z")
was working until this friday night/sat morning . 11.58.5 was auto installed. authentication (oauth2) code redirect hangs . doesnt redeem code for token. basically the “auth” option to authenticate completely broken. … --- ## [Oauth 2.0 window is blank](https://community.postman.com/t/oauth-2-0-window-is-blank/81806)
**Author:** [@brianshei](https://community.postman.com/u/brianshei)\ **Replies:** 0\ **Last updated:** [July 2, 2025, 9:18am UTC](https://community.postman.com/t/oauth-2-0-window-is-blank/81806 "2025-07-02T09:18:36Z")
This is blank when trying to test with keycloak locally using the auth code flow. This works with other IDP’s. Its like its not even sending the request to postman but i cant tell as everything is blank --- ## [Error 404 NOT\_FOUND when calling Salesforce REST API via Client Credentials in Postman](https://community.postman.com/t/error-404-not-found-when-calling-salesforce-rest-api-via-client-credentials-in-postman/80649)
**Author:** [@paula08](https://community.postman.com/u/paula08)\ **Replies:** 8\ **Last updated:** [June 5, 2025, 7:46am UTC](https://community.postman.com/t/error-404-not-found-when-calling-salesforce-rest-api-via-client-credentials-in-postman/80649 "2025-06-05T07:46:04Z")
I have a Salesforce sandbox Connected App configured for OAuth 2.0 Client Credentials (Basic Auth header + grant type=client credentials) with a “Run As” Integration user. In Postman I set up a Collection-level OAuth2 au… --- ## [Couldn't Sign You In](https://community.postman.com/t/couldnt-sign-you-in/11840)
**Author:** [@miryam.gillian](https://community.postman.com/u/miryam.gillian)\ **Replies:** 0\ **Last updated:** [April 9, 2020, 2:51am UTC](https://community.postman.com/t/couldnt-sign-you-in/11840 "2020-04-09T02:51:15Z")
I am trying to setup OAuth2 authentication for Google Photos API requests. I have set this up in Google Developers API & Services. When I complete the form in Postman and click Request Token, I get ‘Couldn’t Sign You I… --- ## [Oauth2 with pkce for Twitter API](https://community.postman.com/t/oauth2-with-pkce-for-twitter-api/49326)
**Author:** [@spaceflight-cosmon13](https://community.postman.com/u/spaceflight-cosmon13)\ **Replies:** 3\ **Last updated:** [April 6, 2025, 10:13am UTC](https://community.postman.com/t/oauth2-with-pkce-for-twitter-api/49326 "2025-04-06T10:13:23Z")
Ok… the error from the Postman console is: “Error: Authentication window was closed” What could it be? What am I missing? I “think” I am using all the right information… postman callback website is good? I had some… --- ## [How to properly set up refresh token request in Postman](https://community.postman.com/t/how-to-properly-set-up-refresh-token-request-in-postman/71203)
**Author:** [@chrisdel](https://community.postman.com/u/chrisdel)\ **Replies:** 2\ **Last updated:** [April 1, 2025, 9:24pm UTC](https://community.postman.com/t/how-to-properly-set-up-refresh-token-request-in-postman/71203 "2025-04-01T21:24:25Z")
I’m trying to refresh my auth token. When I hit the refresh button I get this error "code":400,"error":"invalid\_request","error\_description":"client\_id not specified" I have entered the client\_id in the field and it do… --- ## [Advanced OAuth2 request with custom header](https://community.postman.com/t/advanced-oauth2-request-with-custom-header/75593)
**Author:** [@aviation-physicist-9](https://community.postman.com/u/aviation-physicist-9)\ **Replies:** 1\ **Last updated:** [February 18, 2025, 4:04pm UTC](https://community.postman.com/t/advanced-oauth2-request-with-custom-header/75593 "2025-02-18T16:04:49Z")
Hello. I’m trying to execute an OAuth2 interactive request from Postman using the Advanced feature and adding a custom header. Per this except from the documentation, I should be able to add one: Auth Request , Token … --- ## [Postman CLI - Auto refreshing tokens, supported?](https://community.postman.com/t/postman-cli-auto-refreshing-tokens-supported/74077)
**Author:** [@cruxto](https://community.postman.com/u/cruxto)\ **Replies:** 6\ **Last updated:** [February 14, 2025, 11:47am UTC](https://community.postman.com/t/postman-cli-auto-refreshing-tokens-supported/74077 "2025-02-14T11:47:04Z")
Hi All, Just a quick question: Does the latest version of Postman CLI support the auto-refreshing tokens implemented in the Postman desktop client? I can see it’s working with the desktop client, but I see a 400 staus … --- ## [Oauth 2.0 variable for token name by environment](https://community.postman.com/t/oauth-2-0-variable-for-token-name-by-environment/74596)
**Author:** [@caltucky](https://community.postman.com/u/caltucky)\ **Replies:** 0\ **Last updated:** [January 29, 2025, 6:23pm UTC](https://community.postman.com/t/oauth-2-0-variable-for-token-name-by-environment/74596 "2025-01-29T18:23:24Z")
Sorry, if this has been asked. I’ve looked around but can find exactly what I’m looking for. I currently have an API collection with multiple endpoints. I have oath2.0 configured at the collection/folder level for this … --- ## [OAuth with "+" sign in client secret fails](https://community.postman.com/t/oauth-with-sign-in-client-secret-fails/73716)
**Author:** [@swobi71](https://community.postman.com/u/swobi71)\ **Replies:** 0\ **Last updated:** [January 13, 2025, 10:25am UTC](https://community.postman.com/t/oauth-with-sign-in-client-secret-fails/73716 "2025-01-13T10:25:53Z")
I ran into the following problem (again) a few days ago: When the “Client Secret” of an OAuth2 authorization workflow contains a “+” sign, the request after the consent (/identity.server/connect/token) fails with “inval… --- ## [Create JWT Assertion for OAuth 2.0 using Certificate Credentials?](https://community.postman.com/t/create-jwt-assertion-for-oauth-2-0-using-certificate-credentials/70587)
**Author:** [@mfisher-postman](https://community.postman.com/u/mfisher-postman)\ **Replies:** 0\ **Last updated:** [October 29, 2024, 6:10pm UTC](https://community.postman.com/t/create-jwt-assertion-for-oauth-2-0-using-certificate-credentials/70587 "2024-10-29T18:10:18Z")
I’m working with Microsoft Graph with App-only access (Application permissions). I am trying to get an JWT Bearer access token by using our own App Registration; as recommended/required (1). The documentation states: …… --- ## [AuthType OAuth2.0 Client Secret is always required](https://community.postman.com/t/authtype-oauth2-0-client-secret-is-always-required/69721)
**Author:** [@redeyeddog](https://community.postman.com/u/redeyeddog)\ **Replies:** 4\ **Last updated:** [October 17, 2024, 12:33pm UTC](https://community.postman.com/t/authtype-oauth2-0-client-secret-is-always-required/69721 "2024-10-17T12:33:13Z")
Hi, when using the Authorization tab with the “Auth Type=OAuth2.0” and “Grant type = Authorization Code” why am i always required to have a client\_secret… when some of these flows don’t require it? what am i doing wrong,… --- ## [RFC 6749 / section-2.3.1](https://community.postman.com/t/rfc-6749-section-2-3-1/68244)
**Author:** [@nikola.stojanovic](https://community.postman.com/u/nikola.stojanovic)\ **Replies:** 2\ **Last updated:** [September 11, 2024, 7:13am UTC](https://community.postman.com/t/rfc-6749-section-2-3-1/68244 "2024-09-11T07:13:19Z")
Based on RFC 6749 - The OAuth 2.0 Authorization Framework (ietf.org) in Authorization/OAuth 2.0 when we are using Client Authentication with Basic Auth header client identifier and password should be encoded in Postman --- ## [Replace the env variable value from Authorisation token value](https://community.postman.com/t/replace-the-env-variable-value-from-authorisation-token-value/64065)
**Author:** [@rajirudhra](https://community.postman.com/u/rajirudhra)\ **Replies:** 0\ **Last updated:** [July 14, 2024, 1:40pm UTC](https://community.postman.com/t/replace-the-env-variable-value-from-authorisation-token-value/64065 "2024-07-14T13:40:13Z")
Hi, I am new to Postman, I have a situation to set the environment value while authorising a token. using OAuth2. I wanted to replace the number in the token on one of the environment variable values. It will change … --- ## [PostMan 5.5 fails to complete OAuth 2 requests](https://community.postman.com/t/postman-5-5-fails-to-complete-oauth-2-requests/480)
**Author:** [@blindkoala](https://community.postman.com/u/blindkoala)\ **Replies:** 10\ **Last updated:** [July 18, 2024, 2:31pm UTC](https://community.postman.com/t/postman-5-5-fails-to-complete-oauth-2-requests/480 "2024-07-18T14:31:27Z")
In the 5.4 version of the Postman Chrome app, I am able to successfully request an OAuth2 token from Bungie.net with the provided Auth URL, ClientId, and ClientSecret. With the desktop app, this same flow fails with the… --- ## [Unable to pass Azure AD authentication](https://community.postman.com/t/unable-to-pass-azure-ad-authentication/64102)
**Author:** [@aradsk](https://community.postman.com/u/aradsk)\ **Replies:** 0\ **Last updated:** [July 15, 2024, 12:45pm UTC](https://community.postman.com/t/unable-to-pass-azure-ad-authentication/64102 "2024-07-15T12:45:22Z")
Hi, I have set up a django project using django\_auth\_adfs library which uses Active Directory for the authentication phase and I had to register and application on Azure for this. Now, I’m trying to work with the API I … --- ## [OAuth2 callback not doing anything](https://community.postman.com/t/oauth2-callback-not-doing-anything/63009)
**Author:** [@science-operator-139](https://community.postman.com/u/science-operator-139)\ **Replies:** 1\ **Last updated:** [July 2, 2024, 10:08am UTC](https://community.postman.com/t/oauth2-callback-not-doing-anything/63009 "2024-07-02T10:08:00Z")
Hi folks, I’m having a hard time getting OAuth2 authorizations to work in Postman. I understand the callback approach and every demo I see shows using the pstmn.io/v1/browser-callback but I’m using the app, and I’ve see… --- ## [Automation of OAUTH2.0 token](https://community.postman.com/t/automation-of-oauth2-0-token/62500)
**Author:** [@kayal1postman](https://community.postman.com/u/kayal1postman)\ **Replies:** 1\ **Last updated:** [June 22, 2024, 8:52pm UTC](https://community.postman.com/t/automation-of-oauth2-0-token/62500 "2024-06-22T20:52:07Z")
Hi , I am looking for an assistance in writing automation pre requisite scripts for getting an OAUTH2.0 instead of manually clicking the “Get New Access token” and getting the token via browser.I need to login to the Aut… --- ## [OAuth 2.0 with PKCE](https://community.postman.com/t/oauth-2-0-with-pkce/18931)
**Author:** [@damith.ev](https://community.postman.com/u/damith.ev)\ **Replies:** 3\ **Last updated:** [June 18, 2024, 3:44pm UTC](https://community.postman.com/t/oauth-2-0-with-pkce/18931 "2024-06-18T15:44:27Z")
Hi All, I’m trying to get the Authorization code flow with PKCE in Postman. It seems that the Client secret is still required to get the access token. What’s the reason for this and how can I get it to work without the … --- ## [Missing audience in Oauth2.0 authentication](https://community.postman.com/t/missing-audience-in-oauth2-0-authentication/37817)
**Author:** [@benbouillet](https://community.postman.com/u/benbouillet)\ **Replies:** 7\ **Last updated:** [May 16, 2024, 7:58am UTC](https://community.postman.com/t/missing-audience-in-oauth2-0-authentication/37817 "2024-05-16T07:58:26Z")
I’m implementing Oauth2.0 authentication for minIO (open-source clone of AWS S3) with auth0 as OIDC provider. I’d like to experiment with Postman and to set up authentication at the Collection level using the Authorizat… --- ## [How I can change "Authorization" to "access\_token"](https://community.postman.com/t/how-i-can-change-authorization-to-access-token/59911)
**Author:** [@phuocle](https://community.postman.com/u/phuocle)\ **Replies:** 1\ **Last updated:** [April 14, 2024, 5:22pm UTC](https://community.postman.com/t/how-i-can-change-authorization-to-access-token/59911 "2024-04-14T17:22:34Z")
Hi, can anybody help me how to edit the yellow highlight to text: access\_token If you see in the picture, i do manually add header access\_token, and use variable ACCESS\_TOKEN (this value we manually pasted from the A… --- ## [User-Agent in Postman oAuth2 browser has changed](https://community.postman.com/t/user-agent-in-postman-oauth2-browser-has-changed/59100)
**Author:** [@stuart.gray](https://community.postman.com/u/stuart.gray)\ **Replies:** 8\ **Last updated:** [April 12, 2024, 9:52am UTC](https://community.postman.com/t/user-agent-in-postman-oauth2-browser-has-changed/59100 "2024-04-12T09:52:15Z")
Hello Since the latest Postman upgrade, we’ve noticed a significant change in the User Agent of the Postman OAuth2 browser when attaining an access token using the OAuth2 mechanism. Prior to the upgrade to Postman 10.24… --- ## [Upgrade a http connection to websocket - auth](https://community.postman.com/t/upgrade-a-http-connection-to-websocket-auth/59625)
**Author:** [@aerospace-astronaut6](https://community.postman.com/u/aerospace-astronaut6)\ **Replies:** 0\ **Last updated:** [April 5, 2024, 9:43am UTC](https://community.postman.com/t/upgrade-a-http-connection-to-websocket-auth/59625 "2024-04-05T09:43:46Z")
Hi Folks, I’m building a software backend that contains an HTTP endpoint which can be upgraded to a WebSocket connection. I noticed the “WebSocket” connection type in Postman and was excited to test my WebSocket endpoin… --- ## [Salesforce OAuth2 id token](https://community.postman.com/t/salesforce-oauth2-id-token/57741)
**Author:** [@rkahnert](https://community.postman.com/u/rkahnert)\ **Replies:** 11\ **Last updated:** [February 20, 2024, 8:04pm UTC](https://community.postman.com/t/salesforce-oauth2-id-token/57741 "2024-02-20T20:04:27Z")
I am evaluating switching from Insomnia to Postman and trying to just port some examples to test them out. But I am getting stuck on getting the id token from the Salesforce OAuth2 setup. I have it set up and I can get… --- ## [Refreshing shared tokens](https://community.postman.com/t/refreshing-shared-tokens/57328)
**Author:** [@m0ltar](https://community.postman.com/u/m0ltar)\ **Replies:** 3\ **Last updated:** [February 6, 2024, 5:05pm UTC](https://community.postman.com/t/refreshing-shared-tokens/57328 "2024-02-06T17:05:37Z")
I have shared a token with someone. But then it seems to be not auto-refreshing, even when the auto-refresh is enabled. I am guessing it is because just the access token gets shared, and the rest (app secret, and refres… --- ## [OAuth isn't passing to the request in CLI](https://community.postman.com/t/oauth-isnt-passing-to-the-request-in-cli/57057)
**Author:** [@nategerman](https://community.postman.com/u/nategerman)\ **Replies:** 5\ **Last updated:** [January 31, 2024, 12:45pm UTC](https://community.postman.com/t/oauth-isnt-passing-to-the-request-in-cli/57057 "2024-01-31T12:45:30Z")
I am attempting to run a request in postman cli, but I continually receive a 401 Unauthorized response. The request works consistently when run through the postman app, but fails every time when run through the CLI. Any… --- ## [OAuth 2.0 - Change content type to application/json](https://community.postman.com/t/oauth-2-0-change-content-type-to-application-json/42580)
**Author:** [@danrobo](https://community.postman.com/u/danrobo)\ **Replies:** 1\ **Last updated:** [January 17, 2024, 1:05pm UTC](https://community.postman.com/t/oauth-2-0-change-content-type-to-application-json/42580 "2024-01-17T13:05:28Z")
My question: Is it possible to change the OAuth 2.0 content request type from “application/x-www-form-urlencoded” to “application/json”? This is because the service I am calling only supports request in a body using JS… [Next page](https://community.postman.com/tag/oauth2/86.md?match_all_tags=true&page=1&tags%5B%5D=oauth2)