By Diode Dan

2014-07-12 05:26:23 8 Comments

I'm testing an implementation of JWT Token based security based off the following article. I have successfully received a token from the test server. I can't figure out how to have the Chrome POSTMAN REST Client program send the token in the header.

postman screenshot

My questions are as follows:

1) Am I using the right header name and/or POSTMAN interface?

2) Do I need to base 64 encode the token? I thought I could just send the token back.


@coda 2019-05-06 11:25:33

enter image description here

Everything else ie. Params, Authorization, Body, Pre-request Script, Tests is empty, just open the Headers tab and add as shown in image. Its the same for GET request as well.

@Adi 2019-01-16 16:42:24

If you wish to use postman the right way is to use the headers as such

key: Authorization

value: jwt {token}

as simple as that.

@Dheeraj 2018-10-31 05:12:32

  1. Open postman.
  2. go to "header" field.
  3. there one can see "key value" blanks.
  4. in key type "Authorization".
  5. in value type "Bearer(space)your_access_token_value".


@prasanthv 2014-11-28 05:15:12

Here is an image if it helps :)



The postman team added "Bearer token" to the "authorization tab": Updated postman

@jeffsama 2018-04-24 08:48:45

For people who are using wordpress plugin Advanced Access Manager to open up the JWT Authentication.

The Header field should put Authentication instead of Authorization

enter image description here

AAM mentioned it inside their documentation,

Note! AAM does not use standard Authorization header as it is skipped by most Apache servers. ...

Hope it helps someone! Thanks for other answers helped me alot too!!

@Digitlimit 2017-10-05 10:41:15

Here is how to set token this automatically

On your login/auth request

enter image description here

Then for authenticated page

enter image description here

@Yasitha Bandara 2017-07-01 15:19:10

I did as how moplin mentioned .But in my case service send the JWT in response headers ,as a value under the key "Authorization".

Authorization →Bearer eyJhbGciOiJIUzUxMiJ9.eyJzdWIiOiJpbWFsIiwiZXhwIjoxNDk4OTIwOTEyfQ.dYEbf4x5TGr_kTtwywKPI2S-xYhsp5RIIBdOa_wl9soqaFkUUKfy73kaMAv_c-6cxTAqBwtskOfr-Gm3QI0gpQ

What I did was ,make a Global variable in postman as


in login request->Tests Tab, add

postman.setGlobalVariable("jwt", postman.getResponseHeader("Authorization"));

in other requests select the Headers tab and give



@RamanSM 2017-05-01 16:58:52

Somehow postman didn't work for me. I had to use a chrome extension called RESTED which did work.

@Vucko 2017-03-24 08:57:47

I had the same issue in Flask and after trying the first 2 solutions which are the same (Authorization: Bearer <token>), and getting this:

    "description": "Unsupported authorization type",
    "error": "Invalid JWT header",
    "status_code": 401

I managed to finally solve it by using:

Authorization: jwt <token>

Thought it might save some time to people who encounter the same thing.

@S_M 2017-11-21 15:03:28

I was getting Authentication credentials were not provided in django using Bearer <token>. solved with jwt <token>. Thanks for the solution

@moplin 2017-01-02 15:31:00

I am adding to this question a little interesting tip that may help you guys testing JWT Apis.

Its is very simple actually.

When you log in, in your Api (login endpoint), you will immediately receive your token, and as @mick-cullen said you will have to use the JWT on your header as:

Authorization: Bearer TOKEN_STRING

Now if you like to automate or just make your life easier, your tests you can save the token as a global that you can call on all other endpoints as:

Authorization: Bearer {{jwt_token}}

On Postman: Then make a Global variable in postman as jwt_token = TOKEN_STRING.

On your login endpoint: To make it useful, add on the beginning of the Tests Tab add:

var data = JSON.parse(responseBody);
postman.setGlobalVariable("jwt_token", data.jwt_token);

I am guessing that your api is returning the token as a json on the response as: {"jwt_token":"TOKEN_STRING"}, there may be some sort of variation.

On the first line you add the response to the data varibale. Clean your Global And assign the value.

So now you have your token on the global variable, what makes easy to use Authorization: Bearer {{jwt_token}} on all your endpoints.

Hope this tip helps.

Something to read

About tests on Postman: testing examples

Command Line: Newman

CI: integrating with Jenkins

Nice blog post: master api test automation

@Diode Dan 2017-01-03 20:40:28

Interesting, I'm unfamiliar with the concept of the Test tab and Postman coding. Is there a resource you recommend to get started with this?

@moplin 2017-01-05 02:21:43

Actually Postman is really interesting and pretty strong when it comes to automated testing. You can configure postman in such a way that it can build random data Global variables or Environment variables that you can run on the tests. And make iterative runs and test any response as endpoint unit tests. Save them and find errors when you change code. I haven't used the command line utility but I understand that you can configure it to run in your ci-pipeline.

@moplin 2017-01-05 02:23:51

Your can read about command line here:

@Mick Cullen 2014-07-12 07:23:03

For the request Header name just use Authorization. Place Bearer before the Token. I just tried it out and it works for me.

Authorization: Bearer TOKEN_STRING

Each part of the JWT is a base64url encoded value.

@Diode Dan 2014-07-12 21:34:04

Just as a clarification, the "Header" field becomes Authorization and the "Value" field becomes Bearer[WHITESPACE]<your-code-here>

@Diode Dan 2014-07-13 17:55:29

Do you know what part of the field is encrypted? It appears that the data right after the last '.' separator is giving me what looks like garbage characters. I assume this is actually information encrypted by the Token generator?

@Mick Cullen 2014-07-14 10:27:30

Check out .There is a section where you can paste a JWT and view its decoded contents, its the best way of seeing whats happening. The server secret string is used to make the last section of the token. JWT only signs the payload does not encrypt i.e. you can decode part 1 & 2 of the string but cannot validate it without the secret.

@Mick Cullen 2014-07-14 10:47:16

EXAMPLE. JWT secret = 'This is the secret hush hush!' , Client (sends credentials via http):username and password, Server sends token in http response header: {"token":" eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9. eyJ1c2VyX2lkIjoiNTNjM2E2ZGIxMmFiZmE4MDBjNTRhNDQ2IiwidXNlcm5h‌​bWUiOiJhZG1pbiIsImFk‌​bWluIjp0cnVlLCJjcmVh‌​dGVkIjoiMjAxNC0wNy0x‌​NFQwOTo0NjowMy45NTZa‌​IiwiZW1haWwiOiJtaWNr‌​QDEyMy5pZSIsImlhdCI6‌​MTQwNTMzMTIwNywiZXhw‌​IjoxNDA1MzM0ODA3fQ. LfE_1suABLnAY8IGWd_sOWw1ONVf7KbKGrnJlGbaTsQ"}

@user137717 2015-08-28 05:41:54

Can someone please elaborate on why we need to put Bearer before the JWT? Is this some kind of signal to the server that this is a JWT?

@Michael Noyb 2016-02-16 11:01:03

That is just the convention - you can find all details here:

@J86 2017-08-14 09:11:56

hmm I'm doing this, but I get a 403 Forbidden in my .net core api

Related Questions

Sponsored Content

3 Answered Questions

[SOLVED] What if JWT is stolen?

1 Answered Questions

1 Answered Questions

10 Answered Questions

[SOLVED] JWT (JSON Web Token) automatic prolongation of expiration

6 Answered Questions

[SOLVED] If you can decode JWT how are they secure?

1 Answered Questions

[SOLVED] Scooping headers off of one Postman request and injecting them into others

0 Answered Questions

Signing jwt token with refresh token as payload

2 Answered Questions

[SOLVED] Where to store JWT in browser? How to protect against CSRF?

9 Answered Questions

[SOLVED] JWT (JSON Web Token) library for Java

  • 2014-05-22 13:34:52
  • Marius Manastireanu
  • 102761 View
  • 67 Score
  • 9 Answer
  • Tags:   java json web token jwt

0 Answered Questions

How to pass JWT on header with Swagger

Sponsored Content