Postman Bearer Token and JWT

Most modern APIs protect their data with bearer tokens. A bearer token is a long string that proves who you are, much like a concert wristband. Show the wristband at the door and the staff let you in without asking for your ticket again. Postman sends this token with every request once you configure it.

How Token Login Works

You never send your password with every request. You send it once to a login endpoint, and the server returns a token. Every later request carries that token instead.

  1. POST /login  (email + password)
        │
        ▼
  2. Server checks credentials
        │
        ▼
  3. Server returns  { "token": "eyJhbGci..." }
        │
        ▼
  4. GET /orders
     Authorization: Bearer eyJhbGci...
        │
        ▼
  5. Server accepts the token and returns the orders

What a JWT Looks Like

JWT stands for JSON Web Token. A JWT contains three parts separated by dots.

  xxxxx.yyyyy.zzzzz
    │      │      │
    │      │      └── Signature  (proves nobody changed the token)
    │      └───────── Payload    (user ID, role, expiry time)
    └──────────────── Header     (token type and signing method)

The header and payload are encoded text, not secret text. Anyone can decode them, so never place passwords inside a token. The signature protects the token against tampering.

Typical Payload Fields

Field	Meaning
sub	The user the token belongs to
iat	Time the token was issued
exp	Time the token expires
role	Permission level, such as admin or viewer

Add a Bearer Token in Postman

1. Open a request and click the Authorization tab.
2. Choose Bearer Token from the Auth Type list.
3. Paste the token or type a variable such as {{token}}.
4. Click Send.

Postman adds the header Authorization: Bearer your-token automatically. Open the Headers tab and select Hidden headers to confirm.

Capture the Token Automatically

Copying tokens by hand wastes time. A short script on the login request stores the token in an environment variable.

const data = pm.response.json();
pm.environment.set("token", data.token);

Place this code in the Post-response section of the login request. Every other request that uses {{token}} receives the fresh value without manual work.

Set Authorization Once for a Whole Collection

Click the collection name, open the Authorization tab, and set Bearer Token with {{token}}. Requests inside the collection choose Inherit auth from parent and need no separate setup. A change in one place updates every request.

Decode a JWT for Debugging

Debugging often needs a peek at the payload. A script decodes it inside Postman.

const token = pm.environment.get("token");
const payload = token.split(".")[1];
const decoded = JSON.parse(atob(payload));
console.log(decoded);
console.log("Expires:", new Date(decoded.exp * 1000));

Open the Console at the bottom of the window to read the output. The expiry date explains many sudden 401 errors.

Expired Token Problems

Tokens live for a limited time, often between five minutes and one day. An expired token produces a 401 Unauthorized response. Repair the situation with one of these actions:

• Run the login request again to receive a new token.
• Write a pre-request script that checks the expiry and refreshes the token automatically.
• Use the refresh endpoint if the API supports refresh tokens.

Security Habits

• Store tokens in the current value column, which never syncs to the cloud.
• Share example tokens only when they are fake or already expired.
• Use HTTPS addresses so nobody can read the token on the network.
• Request short-lived tokens for testing whenever the API allows it.

Key Points

• A bearer token acts as a digital wristband that proves identity.
• A JWT contains a header, a payload, and a signature.
• Postman sends the token in the Authorization header.
• A post-response script saves the token to a variable automatically.
• A 401 response after a working period usually means the token expired.