A JWT issued by an API can be sent as a bearer token in later requests. Postman does not make an expired or incorrectly issued token valid; the server still verifies it.
Using a Token
1.
Call the API’s sign-in or token endpoint and check that the response succeeded.
2.
Confirm the JSON field containing the token. The example below assumes access_token.
3.
For local test data, run the script in the request’s post-response script area. Older versions label this area Tests, as shown in the screenshot.
4.
On an authenticated request, choose Bearer Token and enter {{JWT}} in the token field.
Postman adds the Authorization: Bearer header. Do not type Bearer again inside the token value, or also add a conflicting header manually.
Things to Check
The script below stores the value in the selected environment. Use it only with disposable test tokens; use a suitable secrets store such as Postman Vault for real credentials. Check sharing and export settings before saving sensitive values.
A non-JSON error response or a different token field will break the example. Check the response before extracting a value, and obtain a new token when the old one expires.
// Choose "Set an environment variable".
// pm.environment.set("variable_key", "variable_value");
pm.environment.set("JWT", pm.response.json().access_token);
Python
복사
