API authorization is the process of verifying whether an authenticated user or application has permission to access a specific API resource or perform a particular action. It helps protect APIs by allowing only authorized users or applications to access protected resources and sensitive data.
- Determines which resources or operations a user or application can access.
- Works after authentication to enforce access permissions.
- Improves API security by preventing unauthorized access to protected endpoints.
Why is Authorization Required in APIs?
Authorization is required to control access to protected API resources and ensure that only authorized users or applications can perform specific actions. It helps protect sensitive data and prevents unauthorized operations.
- Restricts access to API resources based on user or application permissions.
- Protects sensitive data from unauthorized access and misuse.
- Ensures only authorized users or applications can access protected resources.
How to Configure Authorization in Postman
Postman allows you to configure authorization directly from the Authorization tab for any API request.
Steps to Configure Authorization
- Open or create an API request in Postman.
- Enter the request URL and select the HTTP method.
- Open the Authorization tab.
- Select the required authorization type.
- Enter the required credentials.
- Click Send to execute the request.
Note: The general configuration steps are the same for all authorization types. Only the required credentials differ.
Authorization Types Supported by Postman
Postman supports multiple authorization methods that allow you to authenticate API requests using different security mechanisms.
Inherit Auth from Parent
Inherit Auth from Parent allows a request to automatically use the authorization settings configured at the parent folder or collection level. This helps maintain consistent authentication across related requests and reduces the need to configure authorization for each request individually.
- Automatically inherits authorization from the parent folder or collection.
- Eliminates duplicate authentication settings.
- Updates child requests when the parent authorization changes.
No Auth
No Auth is the simplest authorization type in Postman, where no authentication credentials are included in the API request. It is commonly used for public APIs or endpoints that do not require authentication.
- Sends requests without authorization credentials.
- Suitable for public or unsecured APIs.
- Useful for testing endpoints that do not require authentication.
API Key
API Key authorization authenticates API requests using a unique key provided by the API service. The key can be included in the request header or query parameter, depending on the API requirements.
- Uses a unique key to authenticate API requests.
- Supports both Header and Query Parameter authentication.
- API keys can be stored in environment or collection variables.
Basic Auth
Basic Auth authenticates API requests using a username and password. Postman automatically encodes the credentials and includes them in the Authorization header.
- Uses a username and password for authentication.
- Automatically generates the Authorization header.
- Should be used over HTTPS for better security.
Digest Auth
Digest Auth is a more secure alternative to Basic Auth because it uses a challenge-response mechanism instead of sending credentials directly. It protects user credentials by transmitting hashed authentication data.
- Uses hashed credentials for authentication.
- Provides better security than Basic Auth.
- Reduces the risk of exposing passwords.
Bearer Token
Bearer Token authorization authenticates API requests using an access token. It is commonly used with OAuth 2.0 and JWT-based APIs, where the token is included in the Authorization header.
- Uses an access token instead of a username and password.
- Commonly used with OAuth 2.0.
- Supports JWT access tokens.
Note: JWT (JSON Web Token) is commonly used as a Bearer Token. Postman does not provide a separate JWT authorization type.
OAuth 1.0
OAuth 1.0 is an authorization protocol that authenticates API requests using consumer keys, secrets, and digital signatures. It is primarily used by older or legacy APIs.
- Uses consumer credentials and digital signatures.
- Provides secure request authentication.
- Commonly used by legacy APIs.
OAuth 2.0
OAuth 2.0 is the most widely used authorization framework for modern APIs. It enables applications to securely access protected resources using access tokens without exposing user credentials.
- Uses access tokens for authorization.
- Supports multiple authorization flows.
- Simplifies secure access to protected APIs.
Hawk Authentication
Hawk Authentication is a secure authentication scheme that verifies API requests using cryptographic signatures, timestamps, and nonces. It helps protect requests from tampering and replay attacks.
- Uses cryptographic signatures for authentication.
- Prevents replay attacks using timestamps and nonces.
- Ensures request integrity.
AWS Signature
AWS Signature uses the AWS Signature Version 4 (SigV4) algorithm to authenticate requests to Amazon Web Services. Postman signs requests automatically using the provided AWS credentials.
- Authenticates requests to AWS services.
- Uses the AWS Signature Version 4 algorithm.
- Automatically signs requests with AWS credentials.
NTLM Authentication
NTLM Authentication is a Microsoft authentication protocol commonly used in Windows-based networks and enterprise applications. It verifies user credentials without sending passwords in plain text.
- Designed for Windows authentication.
- Supports domain-based authentication.
- Commonly used in enterprise environments.
Akamai EdgeGrid
Akamai EdgeGrid is an authentication method used to securely access Akamai APIs. It authenticates requests using client credentials and digital signatures.
- Secures communication with Akamai APIs.
- Uses client tokens and digital signatures.
- Requires Akamai API credentials.
ASAP (Atlassian Service Authentication Protocol)
ASAP (Atlassian Service Authentication Protocol) is used for secure communication between Atlassian applications and services. It authenticates requests using signed JSON Web Tokens (JWTs).
- Uses signed JWTs for authentication.
- Enables secure service-to-service communication.
- Commonly used in Atlassian applications.
Applying Authorization at Different Levels
Postman allows you to configure authorization at different levels to simplify authentication management. Authorization settings can be applied to an individual request, a folder, or an entire collection.
- Request Level: Request-level authorization applies authentication settings only to a specific API request. It is useful when a request requires credentials different from other requests.
- Folder Level: Folder-level authorization shares the same authentication settings across all requests within a folder. Child requests can automatically inherit these settings.
- Collection Level: Collection-level authorization applies authentication settings to every request in a collection. It provides centralized authorization management and ensures consistency across related API requests..
Common Authorization Errors and Troubleshooting
- 401 Unauthorized: Invalid or missing authentication credentials.
- 403 Forbidden: The authenticated user or application does not have permission to access the requested resource.
- Invalid API Key: Verify that the API key is correct and added to the appropriate header or query parameter.
- Expired Access Token: Generate or refresh the access token before sending the request.
- Missing Authorization Header: Ensure the correct authorization type is selected and the required credentials are provided.
- Incorrect OAuth Configuration – Verify the client ID, client secret, redirect URI, and token settings.