API Keys, Bearer Tokens, and Basic Auth
Why Authentication Matters
Most real-world APIs are protected, so a request needs to prove who is calling before the server returns any data. Postman's Authorization tab lets you attach the right credentials to a request without writing any extra code.
API Keys
An API key is a unique string issued by the API provider. In Postman you can send it as a query parameter or, more commonly, as a custom header such as x-api-key. Select API Key in the Authorization tab, enter the key name and value, and choose whether it should be added to the header or the query string.
Bearer Tokens
Bearer tokens are typically issued after a login or OAuth flow and sent in the Authorization header as Bearer <token>. Choosing the Bearer Token type in Postman and pasting the token automatically formats the header correctly for you.
Basic Auth
Basic Auth sends a username and password encoded in Base64 inside the Authorization header. Postman handles the encoding automatically once you select Basic Auth and fill in the username and password fields.
| Method | Where Credentials Go | Common Use Case |
|---|---|---|
| API Key | Header or query param | Public/partner APIs |
| Bearer Token | Authorization header | Token-based/JWT APIs |
| Basic Auth | Authorization header (Base64) | Simple internal APIs |
Ready to master Postman API Testing Course?
Join Uncodemy's hands-on training and build real-world API testing skills with expert mentors.