[{"data":1,"prerenderedAt":1544},["ShallowReactive",2],{"navigation_docs":3,"-guide-authorization":172,"-guide-authorization-surround":1539},[4,30,100,134],{"title":5,"icon":6,"path":7,"stem":8,"children":9,"page":29},"Getting started","i-lucide-rocket","\u002Fgetting-started","1.getting-started",[10,14,18,21,25],{"title":11,"path":12,"stem":13},"Introduction","\u002Fgetting-started\u002Fintroduction","1.getting-started\u002F1.introduction",{"title":15,"path":16,"stem":17},"Installation","\u002Fgetting-started\u002Finstallation","1.getting-started\u002F2.installation",{"title":5,"path":19,"stem":20},"\u002Fgetting-started\u002Fquick-start","1.getting-started\u002F3.quick-start",{"title":22,"path":23,"stem":24},"Build from source","\u002Fgetting-started\u002Fbuild-from-source","1.getting-started\u002F4.build-from-source",{"title":26,"path":27,"stem":28},"Troubleshooting","\u002Fgetting-started\u002Ftroubleshooting","1.getting-started\u002F5.troubleshooting",false,{"title":31,"icon":32,"path":33,"stem":34,"children":35,"page":29},"Guide","i-lucide-book-open","\u002Fguide","2.guide",[36,40,44,48,52,56,60,64,68,72,76,80,84,88,92,96],{"title":37,"path":38,"stem":39},"Interface","\u002Fguide\u002Finterface","2.guide\u002F01.interface",{"title":41,"path":42,"stem":43},"Workspace","\u002Fguide\u002Fworkspace","2.guide\u002F02.workspace",{"title":45,"path":46,"stem":47},"Collections","\u002Fguide\u002Fcollections","2.guide\u002F03.collections",{"title":49,"path":50,"stem":51},"HTTP requests","\u002Fguide\u002Fhttp-requests","2.guide\u002F04.http-requests",{"title":53,"path":54,"stem":55},"Variables","\u002Fguide\u002Fvariables","2.guide\u002F05.variables",{"title":57,"path":58,"stem":59},"Authorization","\u002Fguide\u002Fauthorization","2.guide\u002F06.authorization",{"title":61,"path":62,"stem":63},"Scripts and tests","\u002Fguide\u002Fscripts-and-tests","2.guide\u002F07.scripts-and-tests",{"title":65,"path":66,"stem":67},"Collection runner","\u002Fguide\u002Fcollection-runner","2.guide\u002F08.collection-runner",{"title":69,"path":70,"stem":71},"Import and export","\u002Fguide\u002Fimport-export","2.guide\u002F09.import-export",{"title":73,"path":74,"stem":75},"Code snippets","\u002Fguide\u002Fcode-snippets","2.guide\u002F10.code-snippets",{"title":77,"path":78,"stem":79},"gRPC","\u002Fguide\u002Fgrpc","2.guide\u002F11.grpc",{"title":81,"path":82,"stem":83},"WebSocket","\u002Fguide\u002Fwebsocket","2.guide\u002F12.websocket",{"title":85,"path":86,"stem":87},"Cookies, proxy and certificates","\u002Fguide\u002Fcookies-proxy-certificates","2.guide\u002F13.cookies-proxy-certificates",{"title":89,"path":90,"stem":91},"Settings","\u002Fguide\u002Fsettings","2.guide\u002F14.settings",{"title":93,"path":94,"stem":95},"Keyboard shortcuts","\u002Fguide\u002Fkeyboard-shortcuts","2.guide\u002F15.keyboard-shortcuts",{"title":97,"path":98,"stem":99},"Privacy and security","\u002Fguide\u002Fprivacy-and-security","2.guide\u002F16.privacy-and-security",{"title":101,"icon":102,"path":103,"stem":104,"children":105,"page":29},"Reference","i-lucide-square-terminal","\u002Freference","3.reference",[106,110,114,118,122,126,130],{"title":107,"path":108,"stem":109},"Command line","\u002Freference\u002Fcli","3.reference\u002F1.cli",{"title":111,"path":112,"stem":113},"Automation tools","\u002Freference\u002Fautomation-tools","3.reference\u002F2.automation-tools",{"title":115,"path":116,"stem":117},"Scripting API","\u002Freference\u002Fscripting-api","3.reference\u002F3.scripting-api",{"title":119,"path":120,"stem":121},"Dynamic variables","\u002Freference\u002Fdynamic-variables","3.reference\u002F4.dynamic-variables",{"title":123,"path":124,"stem":125},"UI control channel","\u002Freference\u002Fui-control-channel","3.reference\u002F5.ui-control-channel",{"title":127,"path":128,"stem":129},"Workspace format","\u002Freference\u002Fworkspace-format","3.reference\u002F6.workspace-format",{"title":131,"path":132,"stem":133},"Feature status","\u002Freference\u002Ffeature-status","3.reference\u002F7.feature-status",{"title":135,"icon":136,"path":137,"stem":138,"children":139,"page":29},"Contributing","i-lucide-git-pull-request","\u002Fcontributing","4.contributing",[140,144,148,152,156,160,164,168],{"title":141,"path":142,"stem":143},"Contributing overview","\u002Fcontributing\u002Foverview","4.contributing\u002F1.overview",{"title":145,"path":146,"stem":147},"Development","\u002Fcontributing\u002Fdevelopment","4.contributing\u002F2.development",{"title":149,"path":150,"stem":151},"Architecture","\u002Fcontributing\u002Farchitecture","4.contributing\u002F3.architecture",{"title":153,"path":154,"stem":155},"Known gaps","\u002Fcontributing\u002Fgaps","4.contributing\u002F4.gaps",{"title":157,"path":158,"stem":159},"Adding a feature","\u002Fcontributing\u002Fadding-a-feature","4.contributing\u002F5.adding-a-feature",{"title":161,"path":162,"stem":163},"Assets and clean-room","\u002Fcontributing\u002Fassets-and-clean-room","4.contributing\u002F6.assets-and-clean-room",{"title":165,"path":166,"stem":167},"Releasing","\u002Fcontributing\u002Freleasing","4.contributing\u002F7.releasing",{"title":169,"path":170,"stem":171},"Writing the documentation","\u002Fcontributing\u002Fdocumentation","4.contributing\u002F8.documentation",{"id":173,"title":57,"body":174,"description":1532,"extension":1533,"links":1534,"meta":1535,"navigation":1536,"path":58,"seo":1537,"stem":59,"__hash__":1538},"docs\u002F2.guide\u002F06.authorization.md",{"type":175,"value":176,"toc":1517},"minimark",[177,181,184,209,214,276,279,292,304,308,315,829,832,959,965,981,984,991,993,1025,1037,1040,1045,1130,1134,1140,1284,1287,1290,1336,1339,1349,1360,1364,1408,1411,1425,1429,1458,1462,1466],[178,179,180],"p",{},"You can set authorization on a request, a folder or a collection. Postguy applies it when you send the request.",[178,182,183],{},"The generated header or query parameter shows in the request's header table. It is never saved into the collection file.",[178,185,186,187,190,191,196,197,200,201,203,204,208],{},"To edit auth, open the ",[188,189,57],"code",{}," tab of a request or of a ",[192,193,195],"a",{"href":194},"\u002Fguide\u002Fcollections#collection-and-folder-tabs","collection or folder",". Every text field accepts ",[188,198,199],{},"{{variables}}"," (see ",[192,202,53],{"href":54},"), except the OAuth 2.0 block (see ",[192,205,207],{"href":206},"#oauth-20","OAuth 2.0",").",[210,211,213],"h2",{"id":212},"inheritance","Inheritance",[215,216,217,236],"table",{},[218,219,220],"thead",{},[221,222,223,227,230],"tr",{},[224,225,226],"th",{},"Where",[224,228,229],{},"Default",[224,231,232,235],{},[188,233,234],{},"Inherit"," available",[237,238,239,253,265],"tbody",{},[221,240,241,245,250],{},[242,243,244],"td",{},"Collection",[242,246,247],{},[188,248,249],{},"No Auth",[242,251,252],{},"no",[221,254,255,258,262],{},[242,256,257],{},"Folder",[242,259,260],{},[188,261,234],{},[242,263,264],{},"yes",[221,266,267,270,274],{},[242,268,269],{},"Request",[242,271,272],{},[188,273,234],{},[242,275,264],{},[178,277,278],{},"Postguy picks the auth in this order:",[280,281,282,286,289],"ol",{},[283,284,285],"li",{},"The request's own auth.",[283,287,288],{},"Each folder, from the innermost to the outermost.",[283,290,291],{},"The collection.",[178,293,294,295,297,298,300,301,303],{},"The first level that is not ",[188,296,234],{}," wins. ",[188,299,249],{}," counts as a result: it stops the search and sends nothing. The ",[188,302,234],{}," view shows the kind it inherits.",[210,305,307],{"id":306},"auth-kinds","Auth kinds",[178,309,310,311,314],{},"The ",[188,312,313],{},"kind"," is the tag stored in the collection file.",[215,316,317,336],{},[218,318,319],{},[221,320,321,327,330,333],{},[224,322,323,324,326],{},"Kind (",[188,325,313],{},")",[224,328,329],{},"UI label",[224,331,332],{},"Fields (file keys)",[224,334,335],{},"Applied on send",[237,337,338,353,367,400,424,452,499,547,613,630,669,713,743,780,817],{},[221,339,340,345,347,350],{},[242,341,342],{},[188,343,344],{},"inherit",[242,346,234],{},[242,348,349],{},"none",[242,351,352],{},"resolved to a parent, see above",[221,354,355,360,362,364],{},[242,356,357],{},[188,358,359],{},"noauth",[242,361,249],{},[242,363,349],{},[242,365,366],{},"nothing is added",[221,368,369,374,377,397],{},[242,370,371],{},[188,372,373],{},"apikey",[242,375,376],{},"API Key",[242,378,379,382,383,382,386,389,390,393,394,326],{},[188,380,381],{},"key",", ",[188,384,385],{},"value",[188,387,388],{},"location"," (",[188,391,392],{},"header"," or ",[188,395,396],{},"query",[242,398,399],{},"yes. The key name must not be empty. A header of the same name is replaced. A query pair of the same name is replaced, otherwise appended.",[221,401,402,407,410,418],{},[242,403,404],{},[188,405,406],{},"basic",[242,408,409],{},"Basic Auth",[242,411,412,382,415],{},[188,413,414],{},"username",[188,416,417],{},"password",[242,419,420,421],{},"yes, ",[188,422,423],{},"Authorization: Basic \u003Cbase64 of user:password>",[221,425,426,431,434,442],{},[242,427,428],{},[188,429,430],{},"bearer",[242,432,433],{},"Bearer Token",[242,435,436,382,439],{},[188,437,438],{},"token",[188,440,441],{},"prefix",[242,443,420,444,447,448,451],{},[188,445,446],{},"Authorization: \u003Cprefix> \u003Ctoken>",". The prefix defaults to ",[188,449,450],{},"Bearer",". A blank prefix sends the bare token. An empty token is an error.",[221,453,454,459,462,492],{},[242,455,456],{},[188,457,458],{},"digest",[242,460,461],{},"Digest Auth",[242,463,464,382,466,382,468,382,471,382,474,382,477,382,480,382,483,382,486,382,489],{},[188,465,414],{},[188,467,417],{},[188,469,470],{},"realm",[188,472,473],{},"nonce",[188,475,476],{},"nonceCount",[188,478,479],{},"algorithm",[188,481,482],{},"qop",[188,484,485],{},"opaque",[188,487,488],{},"clientNonce",[188,490,491],{},"disableRetryRequest",[242,493,494,495],{},"yes, see ",[192,496,498],{"href":497},"#digest","Digest",[221,500,501,506,509,532],{},[242,502,503],{},[188,504,505],{},"jwt",[242,507,508],{},"JWT Bearer",[242,510,511,382,513,382,515,382,518,382,521,382,524,382,527,382,529],{},[188,512,388],{},[188,514,479],{},[188,516,517],{},"secret",[188,519,520],{},"secretIsBase64",[188,522,523],{},"privateKey",[188,525,526],{},"payload",[188,528,441],{},[188,530,531],{},"headers",[242,533,534,535,538,539,389,541,543,544,546],{},"yes. The token is signed at send. ",[188,536,537],{},"iat"," is added unless the payload has it. In a header it is ",[188,540,446],{},[188,542,450],{}," by default). In the query it is the parameter ",[188,545,438],{},".",[221,548,549,554,557,601],{},[242,550,551],{},[188,552,553],{},"oauth1",[242,555,556],{},"OAuth 1.0",[242,558,559,382,562,382,565,382,567,382,570,382,573,382,576,382,579,382,582,382,584,382,587,382,589,382,592,382,595,382,598],{},[188,560,561],{},"consumerKey",[188,563,564],{},"consumerSecret",[188,566,438],{},[188,568,569],{},"tokenSecret",[188,571,572],{},"signatureMethod",[188,574,575],{},"callbackUrl",[188,577,578],{},"verifier",[188,580,581],{},"timestamp",[188,583,473],{},[188,585,586],{},"version",[188,588,470],{},[188,590,591],{},"addParamsToHeader",[188,593,594],{},"includeBodyHash",[188,596,597],{},"addEmptyParamsToSign",[188,599,600],{},"encodeParamsInHeader",[242,602,603,604,606,607,609,610,612],{},"yes. The signature goes to the ",[188,605,57],{}," header, or into the query when ",[188,608,591],{}," is off. A random nonce is generated when ",[188,611,473],{}," is empty.",[221,614,615,620,622,627],{},[242,616,617],{},[188,618,619],{},"oauth2",[242,621,207],{},[242,623,624,625],{},"see ",[192,626,207],{"href":206},[242,628,629],{},"yes, with a stored access token",[221,631,632,637,640,660],{},[242,633,634],{},[188,635,636],{},"awsv4",[242,638,639],{},"AWS Signature v4",[242,641,642,382,645,382,648,382,651,382,654,382,657],{},[188,643,644],{},"accessKey",[188,646,647],{},"secretKey",[188,649,650],{},"region",[188,652,653],{},"service",[188,655,656],{},"sessionToken",[188,658,659],{},"addAuthDataToQuery",[242,661,662,663,665,666,668],{},"yes. Signed headers are added. With ",[188,664,659],{},", the signature goes into the query instead of the ",[188,667,57],{}," header.",[221,670,671,676,679,708],{},[242,672,673],{},[188,674,675],{},"hawk",[242,677,678],{},"Hawk",[242,680,681,382,684,382,687,382,689,382,692,382,694,382,697,382,700,382,703,382,705],{},[188,682,683],{},"authId",[188,685,686],{},"authKey",[188,688,479],{},[188,690,691],{},"user",[188,693,473],{},[188,695,696],{},"ext",[188,698,699],{},"appId",[188,701,702],{},"dlg",[188,704,581],{},[188,706,707],{},"includePayloadHash",[242,709,420,710,712],{},[188,711,57],{}," header",[221,714,715,720,722,737],{},[242,716,717],{},[188,718,719],{},"ntlm",[242,721,349],{},[242,723,724,382,726,382,728,382,731,382,734],{},[188,725,414],{},[188,727,417],{},[188,729,730],{},"domain",[188,732,733],{},"workstation",[188,735,736],{},"disableRetry",[242,738,739,742],{},[740,741,252],"strong",{},", stored only",[221,744,745,750,752,776],{},[242,746,747],{},[188,748,749],{},"edgegrid",[242,751,349],{},[242,753,754,382,757,382,760,382,763,382,765,382,767,382,770,382,773],{},[188,755,756],{},"accessToken",[188,758,759],{},"clientToken",[188,761,762],{},"clientSecret",[188,764,473],{},[188,766,581],{},[188,768,769],{},"baseUri",[188,771,772],{},"headersToSign",[188,774,775],{},"maxBody",[242,777,778,742],{},[740,779,252],{},[221,781,782,787,789,813],{},[242,783,784],{},[188,785,786],{},"asap",[242,788,349],{},[242,790,791,382,793,382,796,382,799,382,802,382,804,382,807,382,810],{},[188,792,479],{},[188,794,795],{},"issuer",[188,797,798],{},"audience",[188,800,801],{},"keyId",[188,803,523],{},[188,805,806],{},"subject",[188,808,809],{},"additionalClaims",[188,811,812],{},"expiry",[242,814,815,742],{},[740,816,252],{},[221,818,819,822,824,827],{},[242,820,821],{},"any other tag",[242,823,349],{},[242,825,826],{},"everything is kept verbatim",[242,828,252],{},[178,830,831],{},"Algorithm and method values:",[215,833,834,844],{},[218,835,836],{},[221,837,838,841],{},[224,839,840],{},"Field",[224,842,843],{},"Values",[237,845,846,870,884,929],{},[221,847,848,853],{},[242,849,850,851],{},"Digest ",[188,852,479],{},[242,854,855,382,858,382,861,382,864,382,867],{},[188,856,857],{},"md5",[188,859,860],{},"md5Sess",[188,862,863],{},"sha256",[188,865,866],{},"sha256Sess",[188,868,869],{},"sha512256",[221,871,872,877],{},[242,873,874,875],{},"Hawk ",[188,876,479],{},[242,878,879,382,881],{},[188,880,863],{},[188,882,883],{},"sha1",[221,885,886,891],{},[242,887,888,889],{},"JWT ",[188,890,479],{},[242,892,893,382,896,382,899,382,902,382,905,382,908,382,911,382,914,382,917,382,920,382,923,382,926],{},[188,894,895],{},"hs256",[188,897,898],{},"hs384",[188,900,901],{},"hs512",[188,903,904],{},"rs256",[188,906,907],{},"rs384",[188,909,910],{},"rs512",[188,912,913],{},"es256",[188,915,916],{},"es384",[188,918,919],{},"es512",[188,921,922],{},"ps256",[188,924,925],{},"ps384",[188,927,928],{},"ps512",[221,930,931,936],{},[242,932,933,934],{},"OAuth 1.0 ",[188,935,572],{},[242,937,938,382,941,382,944,382,947,382,950,382,953,382,956],{},[188,939,940],{},"hmacSha1",[188,942,943],{},"hmacSha256",[188,945,946],{},"hmacSha512",[188,948,949],{},"rsaSha1",[188,951,952],{},"rsaSha256",[188,954,955],{},"rsaSha512",[188,957,958],{},"plaintext",[178,960,961,964],{},[188,962,963],{},"{{variable}}"," expansion on send covers Basic, Bearer, API Key, Digest, JWT, OAuth 1.0, AWS v4 and Hawk.",[966,967,968,971,974],"warning",{},[178,969,970],{},"NTLM, Akamai EdgeGrid and ASAP are stored so that collections and imports round-trip without losing them. They are not applied.",[178,972,973],{},"The UI has no editor for them. It only shows that the kind is kept from the file.",[178,975,976,977,980],{},"Sending a request that resolves to one of them fails with ",[188,978,979],{},"this auth type is not supported yet (v1 sends Basic, Bearer, API key, Digest, JWT, OAuth 1.0, AWS v4 and Hawk)",". The request is not sent unauthenticated.",[178,982,983],{},"If the file names an auth kind this build does not know, Postguy keeps it as is. Resolving to it adds nothing to the request.",[178,985,986,987,990],{},"The selected kind is also exported and imported with ",[192,988,989],{"href":70},"Postman and OpenAPI documents",". OpenAPI security schemes map to Basic, Bearer, API Key and OAuth 2.0.",[210,992,498],{"id":458},[994,995,996,1005],"ul",{},[283,997,998,1004],{},[740,999,1000,1001,1003],{},"With a ",[188,1002,473],{}," filled in:"," Postguy answers directly from the stored challenge values.",[283,1006,1007,1013,1014,1017,1018,1021,1022,546],{},[740,1008,1009,1010,1012],{},"With an empty ",[188,1011,473],{},":"," Postguy first sends the request without credentials. If the server replies ",[188,1015,1016],{},"401"," with a ",[188,1019,1020],{},"WWW-Authenticate"," header, Postguy computes the answer from that challenge and retries once. The console shows the warning ",[188,1023,1024],{},"Digest challenge accepted; request retried once",[178,1026,1027,1028,1030,1031,1033,1034,1036],{},"Turn on ",[188,1029,491],{}," to send only the first request and see the ",[188,1032,1016],{}," yourself. An empty ",[188,1035,488],{}," generates a random one.",[210,1038,207],{"id":1039},"oauth-20",[1041,1042,1044],"h3",{"id":1043},"grants","Grants",[215,1046,1047,1060],{},[218,1048,1049],{},[221,1050,1051,1054,1057],{},[224,1052,1053],{},"Grant (UI)",[224,1055,1056],{},"File value",[224,1058,1059],{},"Token flow",[237,1061,1062,1076,1089,1105,1118],{},[221,1063,1064,1067,1073],{},[242,1065,1066],{},"Authorization Code",[242,1068,1069,1072],{},[188,1070,1071],{},"authorizationCode"," (default)",[242,1074,1075],{},"system browser plus a loopback listener",[221,1077,1078,1081,1086],{},[242,1079,1080],{},"Authorization Code (PKCE)",[242,1082,1083],{},[188,1084,1085],{},"authorizationCodeWithPkce",[242,1087,1088],{},"the same, with a PKCE challenge",[221,1090,1091,1094,1099],{},[242,1092,1093],{},"Implicit",[242,1095,1096],{},[188,1097,1098],{},"implicit",[242,1100,1101,1104],{},[740,1102,1103],{},"not wired",": the button is disabled",[221,1106,1107,1110,1115],{},[242,1108,1109],{},"Password Credentials",[242,1111,1112],{},[188,1113,1114],{},"passwordCredentials",[242,1116,1117],{},"direct request to the token URL",[221,1119,1120,1123,1128],{},[242,1121,1122],{},"Client Credentials",[242,1124,1125],{},[188,1126,1127],{},"clientCredentials",[242,1129,1117],{},[1041,1131,1133],{"id":1132},"get-a-token","Get a token",[178,1135,1136,1137,546],{},"Fill in the fields, then press ",[188,1138,1139],{},"Get New Access Token",[215,1141,1142,1151],{},[218,1143,1144],{},[221,1145,1146,1148],{},[224,1147,840],{},[224,1149,1150],{},"Purpose",[237,1152,1153,1163,1173,1183,1196,1211,1221,1234,1247,1271],{},[221,1154,1155,1160],{},[242,1156,1157],{},[188,1158,1159],{},"Authorization URL",[242,1161,1162],{},"Browser step of the code grants.",[221,1164,1165,1170],{},[242,1166,1167],{},[188,1168,1169],{},"Token URL",[242,1171,1172],{},"Token endpoint for every grant.",[221,1174,1175,1180],{},[242,1176,1177],{},[188,1178,1179],{},"Refresh URL",[242,1181,1182],{},"Optional override for refreshing. The token URL is used when empty.",[221,1184,1185,1193],{},[242,1186,1187,382,1190],{},[188,1188,1189],{},"Client ID",[188,1191,1192],{},"Client secret",[242,1194,1195],{},"Sent as a Basic header or in the body, see below.",[221,1197,1198,1206],{},[242,1199,1200,382,1203],{},[188,1201,1202],{},"Scope",[188,1204,1205],{},"State",[242,1207,1208,1210],{},[188,1209,1205],{}," is generated if empty.",[221,1212,1213,1218],{},[242,1214,1215],{},[188,1216,1217],{},"Callback URL",[242,1219,1220],{},"Filled in for you during a browser flow.",[221,1222,1223,1231],{},[242,1224,1225,382,1228],{},[188,1226,1227],{},"Username",[188,1229,1230],{},"Password",[242,1232,1233],{},"Password grant only.",[221,1235,1236,1244],{},[242,1237,1238,382,1241],{},[188,1239,1240],{},"Header prefix",[188,1242,1243],{},"Token name (URL)",[242,1245,1246],{},"How the token is added to a request, see below.",[221,1248,1249,1254],{},[242,1250,1251],{},[188,1252,1253],{},"Extra params",[242,1255,1256,1257,1260,1261,1264,1265,1267,1268,1270],{},"Key and value rows, each delivered in the ",[188,1258,1259],{},"body",", the ",[188,1262,1263],{},"url"," or the ",[188,1266,531],{},". On the token request, only ",[188,1269,1259],{}," rows are sent. On the authorization URL, every row is appended to the query.",[221,1272,1273,1281],{},[242,1274,1275,382,1278],{},[188,1276,1277],{},"Access token",[188,1279,1280],{},"Refresh token",[242,1282,1283],{},"Filled by the flow. You can also type them.",[178,1285,1286],{},"Client credentials and password grants send one request to the token URL.",[178,1288,1289],{},"The two code grants work like this:",[280,1291,1292,1302,1327,1333],{},[283,1293,1294,1295,1298,1299,546],{},"Postguy starts a listener on ",[188,1296,1297],{},"127.0.0.1"," with an ephemeral port and builds the redirect URI ",[188,1300,1301],{},"http:\u002F\u002F127.0.0.1:\u003Cport>\u002Fcallback",[283,1303,1304,1305,1308,1309,1312,1313,1316,1317,389,1320,1323,1324,208],{},"It opens the authorization URL in your system browser with ",[188,1306,1307],{},"response_type=code"," and the ",[188,1310,1311],{},"state",". For PKCE it also sends ",[188,1314,1315],{},"code_challenge"," and ",[188,1318,1319],{},"code_challenge_method",[188,1321,1322],{},"S256",", or ",[188,1325,1326],{},"Plain",[283,1328,1329,1330,1332],{},"The listener waits up to five minutes for the redirect, checks ",[188,1331,1311],{}," and takes the code. It reads at most an 8 KiB request line, then closes.",[283,1334,1335],{},"Postguy exchanges the code at the token URL (with the PKCE verifier for the PKCE grant).",[178,1337,1338],{},"The app shows progress and errors in its status text.",[178,1340,1341,1344,1345,1348],{},[188,1342,1343],{},"Authorize using browser"," is stored in the file as ",[188,1346,1347],{},"useBrowser",". The app does not read it, so the code grants always use the browser.",[178,1350,1351,1352,1355,1356,1359],{},"Client authentication is ",[188,1353,1354],{},"Client secret in Basic header"," (default) or ",[188,1357,1358],{},"Client secret in body",". The token request is a form POST with a 30 second timeout, a 4 MiB response cap and the global proxy and TLS settings.",[1041,1361,1363],{"id":1362},"use-the-token","Use the token",[215,1365,1366,1376],{},[218,1367,1368],{},[221,1369,1370,1373],{},[224,1371,1372],{},"Setting",[224,1374,1375],{},"Effect",[237,1377,1378,1392],{},[221,1379,1380,1385],{},[242,1381,1382,1072],{},[188,1383,1384],{},"Header",[242,1386,1387,447,1390,546],{},[188,1388,1389],{},"Authorization: \u003CHeader prefix> \u003Ctoken>",[188,1391,450],{},[221,1393,1394,1399],{},[242,1395,1396],{},[188,1397,1398],{},"URL",[242,1400,1401,1402,1404,1405,546],{},"The token is appended to the query under ",[188,1403,1243],{},", default ",[188,1406,1407],{},"access_token",[178,1409,1410],{},"A send fails in two cases:",[994,1412,1413,1419],{},[283,1414,1415,1416,546],{},"No token: ",[188,1417,1418],{},"no access token; run the authorization flow first",[283,1420,1421,1422,546],{},"The stored expiry has passed and no refresh was possible: ",[188,1423,1424],{},"the access token has expired; refresh it first",[1041,1426,1428],{"id":1427},"refresh-and-storage","Refresh and storage",[994,1430,1431,1441,1448,1455],{},[283,1432,310,1433,1436,1437,1440],{},[188,1434,1435],{},"Refresh"," button is enabled when a refresh token exists. ",[188,1438,1439],{},"expires in \u003Cn>s"," shows next to it when the server reported an expiry.",[283,1442,1443,1444,1447],{},"Before a send, Postguy refreshes a token that is past its expiry, if there is a refresh token. The console warns ",[188,1445,1446],{},"OAuth 2.0 access token refreshed",". The new refresh token and scope replace the old ones when the server returns them.",[283,1449,1450,1451,1316,1453,546],{},"Access and refresh tokens live in the workspace secrets file, not in the collection file, like secret variables. The UI masks them. Exports that strip secrets blank them. See ",[192,1452,41],{"href":42},[192,1454,69],{"href":70},[283,1456,1457],{},"The OAuth 2.0 block is not variable-expanded on send. Type literal values for URLs, client ID and secret.",[1459,1460,1461],"note",{},"OAuth 2.0 is partial. The implicit grant and a screen for managing several stored tokens are missing. Each request holds one token pair.",[210,1463,1465],{"id":1464},"headless","Headless",[1467,1468,1469,1479,1500],"tip",{"title":1465},[178,1470,1471,1474,1475,1478],{},[188,1472,1473],{},"oauth2_token"," runs a token flow for a request whose auth is OAuth 2.0 and stores the result. ",[188,1476,1477],{},"mode"," is one of:",[994,1480,1481,1487,1492],{},[283,1482,1483,1486],{},[188,1484,1485],{},"grant",": client credentials or password.",[283,1488,1489,546],{},[188,1490,1491],{},"refresh",[283,1493,1494,1496,1497,1499],{},[188,1495,188],{},": exchange an authorization code you got elsewhere, with ",[188,1498,578],{}," for PKCE.",[178,1501,1502,1503,1506,1507,1510,1511,1514,1515,546],{},"The tool does not start browser flows. Set the auth itself with ",[188,1504,1505],{},"request_update"," (the ",[188,1508,1509],{},"definition"," is the serialized request). Send with ",[188,1512,1513],{},"request_send",", which applies inherited auth, Digest retry and automatic refresh. Tools take ids, not names. See ",[192,1516,111],{"href":112},{"title":1518,"searchDepth":1519,"depth":1519,"links":1520},"",2,[1521,1522,1523,1524,1531],{"id":212,"depth":1519,"text":213},{"id":306,"depth":1519,"text":307},{"id":458,"depth":1519,"text":498},{"id":1039,"depth":1519,"text":207,"children":1525},[1526,1528,1529,1530],{"id":1043,"depth":1527,"text":1044},3,{"id":1132,"depth":1527,"text":1133},{"id":1362,"depth":1527,"text":1363},{"id":1427,"depth":1527,"text":1428},{"id":1464,"depth":1519,"text":1465},"Set auth on a request, folder or collection. Auth kinds, inheritance and OAuth 2.0 flows.","md",null,{},true,{"title":57,"description":1532},"BrMBZYbNaBIv95qAnGMf2wePmx93zXjxYfXYj-xvAD0",[1540,1542],{"title":53,"path":54,"stem":55,"description":1541,"children":-1},"Use variables in requests. Scopes, precedence, environments, globals, secrets, dynamic variables and body shortcodes.",{"title":61,"path":62,"stem":63,"description":1543,"children":-1},"Pre-request and post-response scripts, the Tests tab with 28 assertion operators, execution order and sandbox limits.",1793179613009]