Authentication & Token Management

Practice authentication and token management exercises.

Exercise 1: Validate Login Token Generation

Generate an authentication token using:

POST /auth

Advertisement

with valid credentials.

Exercise 2: Extract the Access Token

Extract the authentication token dynamically from the response.

Exercise 3: Handle Refresh Tokens

Validate refresh-token logic.

Exercise 4: Validate Expired Tokens

Verify API behavior when the token expires.

Exercise 5: Validate Invalid Tokens

Send invalid tokens and validate the response.

Exercise 6: Validate Token Reuse

Reuse the same token across multiple secured APIs.

Exercise 7: Validate Role-Based APIs

Verify access based on user roles.

Exercise 8: Validate Different User Access

Validate API access for multiple users.

Exercise 9: Validate Logout Invalidation

Verify that logout invalidates the authentication token.

Exercise 10: Secure Sensitive Data

Store credentials and tokens securely inside Postman.

RESTful Booker Authentication Flow

Practice the following:

  • Generate Token
  • Validate Token is Not Null
  • Store Token Dynamically
  • Pass Token to Secured APIs

Validate the following scenarios:

  • Invalid Credentials → 401
  • Empty Request Body → Error
  • Expired Token → 403
  • Invalid Token → 403

Extracting and Passing the Token (With Code)

Extract the Token

Store the authentication token from the /auth response in an environment variable.

 
pm.environment.set("token", pm.response.json().token);
 

Pass the Token

RESTful Booker uses a Cookie header.

 
Cookie: token={{token}}
 

Dynamic Token Flow

After storing the token:

  • PUT requests reuse {{token}}
  • PATCH requests reuse {{token}}
  • DELETE requests reuse {{token}}

This dynamic token flow forms the foundation of API chaining.

Invalid, Expired & Reused Tokens

Practice token validation scenarios.

Invalid Token

Use an invalid token.

Validate:

403 — Forbidden

Missing Token

Skip sending the token.

Validate:

401 — Unauthorized

Token Reuse

Reuse the same token across multiple secured APIs.

Verify that it continues working until expiration.

Expired Token

Validate expired-token behavior.

Logout Validation

Verify that the token becomes invalid after logout.

Variables & Environments

Practice managing variables and environments.

Exercise 1: Create Environment Variables

Create reusable environment variables.

Exercise 2: Replace Hardcoded URLs

Replace hardcoded URLs with:

{{baseUrl}}

Exercise 3: Store Dynamic IDs

Store response values such as:

bookingId

Exercise 4: Pass Variables Between Requests

Reuse stored variables in subsequent requests.

Exercise 5: Handle Environment-Specific Tokens

Maintain separate authentication tokens for different environments.

Exercise 6: Reset Variables

Clear variables after execution where required.

Exercise 7: Handle Parallel Execution

Prevent variable conflicts during parallel execution.

Exercise 8: Secure Secrets

Store sensitive information securely within environments.

Exercise 9: Validate Environment Switching

Switch between:

  • DEV
  • QA

without modifying requests.

Exercise 10: Use Local Variables

Use local variables for isolated execution.

Variable Usage Pattern

Store values such as:

  • token
  • bookingId

Reuse them using:

  • {{token}}
  • {{bookingId}}
  • {{baseUrl}}

Switch the active environment to execute the same collection across environments without editing individual requests.

Demo-API Mapping

Authentication & Token Handling

Practice using:

  • RESTful Booker
  • GoRest

Exercises include:

  • Token Generation
  • Cookie Header Authentication
  • Token Authentication
  • Role-Based Testing

Variables & Environments

Practice using RESTful Booker.

Variables include:

  • {{baseUrl}}
  • {{token}}
  • {{bookingId}}

Also practice:

  • DEV Environment
  • QA Environment

FAQs

How Do You Extract a Token in Postman?

Use the following code in the Tests tab.

 
pm.environment.set("token", pm.response.json().token);
 

This stores the token as an environment variable for future requests.

How Do You Pass the Token to Secured Requests?

Reference the stored variable in the request header.

For RESTful Booker:

 
Cookie: token={{token}}
 

Other APIs may use an Authorization Bearer header.

What Do Invalid and Missing Tokens Return?

Invalid Token

  • 403 — Forbidden

Missing Token

  • 401 — Unauthorized

How Do You Switch Between Environments?

Store environment-specific values such as:

  • Base URL
  • Credentials

Change the active environment.

Variables like {{baseUrl}} resolve automatically.

How Do You Store a Dynamic ID?

Use the following code in the Tests tab.

 
pm.environment.set("bookingId", pm.response.json().bookingid);
 

Reuse the value later as:

{{bookingId}}

How Do You Secure Secrets in Postman?

Store credentials and authentication tokens in environment variables instead of hardcoding them into requests.