PingOne Platform APIs

OAuth 2.0

OAuth (short for "Open Authorization") is an open standard that grants websites or applications access to users' information on other websites without giving them their passwords.

When authorization is set to OAuth 2.0, instead of the default Bearer Token, you use Postman’s automatic OAuth features to retrieve and refresh tokens. You also use your browser to authenticate your session, which improves platform operational security and developer experience.

To configure a PingOne collection to use OAuth 2.0 for authorization:

  1. Click on the collection.

  2. Click the Authorization tab.

  3. Select OAuth 2.0 from Type.

  4. Select Request Headers from Add auth data to.

  5. In Token, select any unexpired token previously generated.

  6. In Header Prefix, type Bearer.

    You must Configure New Token, if none are available in Token.

  7. In Token Name, type any name. If you generate more than one token, this appears in Token to select a valid token.

  8. Select Client Credentials from Grant Type.

  9. In Access Token URL, type {{authPath}}/{{adminEnvID}}/as/token.

  10. In Client ID, type {{adminAppID}}.

  11. In Client Secret, type {{adminAppSecret}}.

  12. Scope is not required in this use case, leave blank.

  13. Select Send as Basic Auth Header from Client Authentication.

  14. In Refresh Token URL, type {{authPath}}/{{adminEnvID}}/as/token.

You must set appropriate values on the variables used in the configuration in your environment variables template:

  • {{authPath}}

    You must set the value of {{tld}} to the top level domain (TLD) appropriate to your region. Refer to PingOne API domains for more information.

  • {{adminEnvID}}

  • {{adminAppID}}

  • {{adminAppSecret}}

To generate a new access token:

  1. Click Get New Access Token.

    The Get new access token dialog appears.

  2. Click Proceed. If you do nothing, the dialog proceeds after 5 seconds.

    The Manage Access Tokens dialog appears.

  3. Click Use Token. Postman applies the access token to requests with Authorization Inherit auth from parent until it expires.

  4. If Postman does not automatically refresh the access token, repeat these steps.