Hi and welcome to this video on using
simple authentication with Postman. So
some APIs are public and they allow
anyone to interact with them, but in many
cases actions will be restricted by
authentication authorization. So in order
to interact with an API you will often
need to authenticate yourself in some
way. There are a number of different ways
that this can be done, and often approach
taken will vary from one API to the next,
so you'll need to figure out what the
API that you're testing offers. But we'll
quickly highlight in this video a few of
the common options, that you know have an
idea of how to approach this topic. So if
you're working with a public API, a
common way to get access is through
something called a personal token. These
are tokens that you can easily generate
within an application, and they make it
easy to get programmatic access to the
API. So these tokens can be set up to
restrict things in different ways and
they're quite popular. Let's take a look
at a real-life example of this. So we
have here GitHub, and in GitHub we can go
to the settings,
and then we can scroll down here to
developer settings, we'll click on that
and then we can add a personal access
token. So let's create or generate a new
token, we'll give it a name we'll just
call it test for now, our test off token
sure we'll call it that, and then we'll
go down here we'll give it delete repo
permissions. That says this token is
allowed to delete repo. And let's
generate that token, and we'll go ahead
and copy it, and then we'll go over to
Postman. And in Postman you can see I've
set up a delete call here to delete a
repo. But first let's try it with no auth,
so there's no authentication or
authorization set up, and let's see what
happens. So we'll send that command and
we get this message back, you must have
admin rights to the repository. Ok so we
don't have the correct permissions. So
now let's try to use our token and see
what happens. So we'll go down here we'll
choose bearer token, and we'll just paste
in the token that we copied.
And now let's take a quick look just at
what's going on here. So let's preview
the request, so we'll preview it. Now we
can see it's added this little headers
thing, let's go look at that. And here in
the headers we have an authorization key,
and then it added bearer in front of the
token that we had. Now Bearer just tells
us that we're using something called
OAuth, it's just a way of letting the
server know what kind of token this is
so that knows what it's doing, and then
this authorization header is what tells
the server that we're looking at the
authorization here. So we've got
everything set up, and let's actually
send this command and see what happens.
And now we don't get the permissions
area anymore, we have this 2a4 know
content, that means the content has been
removed and our command was successful.
And so we can see that it's pretty easy
to set things up in the case of GitHub,
and a lot of other APIs will have this
kind of functionality available for you.
So that is one simple way that you can
do authorization, is if you have a token
you can just add the token in as a
bearer token, other options - you might
use oauth2 which is very similar we
could have used the same access token
here in oh oh ah -. And then another
option that you might see sometimes is
basic auth, and basic auth is kind of
like it sounds right, we just give our
username and our password, and then we
can authenticate and authorize against
those. So by setting these up it allows
us to be able to send the commands that
we want to the server, and do things that
require authorization or authentication
in order to do. Now this is just a really
quick overview of authorization and how
to approach it, but fortunately for us
Postman abstracts away a lot of
complexity of this, there's actually a
lot of complexity going on behind the
hood here. But hopefully then if you're
using Postman it won't be too difficult
to figure out authentication with the
API that you're working on. And that
brings us to the end of this video. In
the next video, we'll talk about some of
the risks that there are around using
services and APIs, hope to see you there.