Setup OAuth using Postman
Setup OAuth authorization for swagger via Postman
Last updated
Setup OAuth authorization for swagger via Postman
Last updated
This guide is created by a community member and is not managed by Umbraco HQ. Some attributes may change in the future because of the integration with Postman (third-party tool).
This guide covers how to set up OAuth authorization for the Management API using Postman.
Before proceeding, make sure to read the Management API article. It provides information about Authorization and why it is needed in this article.
This guide covers the following:
Open the swagger UI at {yourdomain}/umbraco/swagger.
Choose Umbraco Management API from Select a definition.
Open the JSON file, which you can find right underneath the Title:
Save the JSON file to disk. The name of the file will be saved by default with the name of swagger.json.
Click to create a new collection in Postman.
Import the swagger.json file.
Choose Postman Collection when prompted.
Once imported, you will see a new collection called Umbraco Management API.
Click on Variables tab in the Umbraco Management API collection.
Add a new variable called baseUrl and in the Initial and Current values add your URL, which in this example we use the localhost URL (without trailing slashes):
The localhost URL might vary from this example. Make sure to change the URL to the current localhost URL your project is running on.
Save the changes.
To set up authorization values, follow these steps:
Click on Authorization tab in the Umbraco Management API collection.
Choose OAuth 2.0 from Type
Check if these attributes are set:
Add auth data is set to Request Headers
Auto-refresh token is Disabled
Now let's setup a new token:
Add a Token name called BackofficeSwagger under Configure New Token. The token name can be anything.
Choose Authorization Code (With PKCE) from Grant Type.
Click to enable Authorize using browser on Callback URL.
Add the following on Auth URL:
Add the following on Access Token URL:
Add umbraco-postman on Client ID.
Choose SHA-256 from Code Challenge Method .
Choose Send Client credentials in body from Client Authentication.
Any other field should either be empty or auto-filled by default.
Click Save.
Click on Get New Access Token. A window appears to authenticate into the Backoffice. Follow the given instruction to Open in Postman.
You will see a new Manage access tokens window in Postman.
Click Use Token.
Click on Authorization tab in the Umbraco Management API collection .
Click on Clear Cookies at the bottom of the page above the Get New Access Token.
Open your localhost instance of Umbraco in the browser. Example: https://localhost:44331.
Inspect the page, go to Application tab and clear the UmbracoBackOffice cookie.
Click on Get New Access Token in Postman and
Click on Use Token after authentication.
When trying to obtain a token you might run into an error. If you see the message Error: localhost request not supported in the Postman console, it means the Postman agent is missing. To resolve this issue, you can download the Postman agent from the Postman website Postman website and try again.
When requesting a token, you might get an error that reads Error: unable to verify the first certificate in the console. To resolve this:
Click on the Settings cog wheel in the top right corner next to the Invite button.
Click on Settings and disable SSL certificate verification.
When making a request for the first time, follow these steps:
Click on the Authorization tab in the Umbraco Management API collection.
Choose Inherit auth from parent from Type.
Disable any parameters you are not using as Postman sets their value to default sometimes.
Click Save
