Add API authorization details to requests in Postman

With a request open in Postman, use the Authorization tab to select an auth type, then complete the relevant details for your selected type. The correct data values are determined by your API at the server side. If you’re using a third-party API, refer to the provider’s documentation for any required auth details.

You can use Guided Auth to set up authentication credentials for supported public APIs. For more information, see Set up authorization for public APIs using Guided Auth.

Select an authorization type

When you select an auth type from the Auth type dropdown list, Postman indicates which parts of the request your details are included in. For example, the header, body, URL, or query parameters. Postman then adds your auth details to the relevant parts of the request when you select or enter them. This enables you to preview how Postman will send your data before you run the request.

For more details on setting up each type of authorization, see Authorization types supported by Postman.

You can use these auth types in Postman, in monitors, and in the Postman CLI.

View authorization details

After you select and set up an authorization type, your data appears in the relevant parts of the request. For example, in the Headers tab, click hidden to view headers that were added automatically.

Hover over a header to get information about where it was added. To change an auth header, return to the Authorization tab and update your configuration.

You can’t override headers added by your Authorization selections in the Headers tab. If you need auth headers that are different from those generated by Postman, change your setup in Authorization. You can also remove your auth setup and manually add the headers.

Your request auth can use environment, collection, and global variables. Postman doesn’t save header data or query parameters to avoid exposing sensitive data, such as API keys.

It’s recommended that you use your Postman Vault to store sensitive data as vault secrets.

You can inspect a raw dump of the entire request including auth data in the Postman Console after you send it.

Inherit authorization

You can specify auth details in a parent collection or folder, and reuse the parent’s auth details throughout its grouped requests.

Inherit auth in a request

In a request’s Authorization tab, the Auth type dropdown list shows the parent auth type in the Inherited section at the top. Requests inherit auth from their parent by default, so the request uses the parent’s auth details unless you select a different auth type.

To return a request to the parent’s auth after you override it, select the option in the Inherited section of the Auth type dropdown list.

To edit the parent’s auth details, click Edit in Parent.

Inherit auth in a folder

In a folder’s Authorization tab, Postman marks which auth the folder inherits with an Inherited label. The tab includes these buttons:

Edit in Parent - Opens the parent to edit its auth details.
Change - Provides options for overriding the folder’s inherited auth, including No Auth.