API authorization helpers, from API keys to OAuth 2.0

Supported schemes

Every field accepts {{variables}}, so credentials can live in an environment or the vault rather than in the request.

Inherit auth from folders and collections

Set auth once on a collection or folder and leave requests on Inherit auth from parent. A request can override it, or use No auth for public endpoints such as a login call. Code snippets and runs use the same effective auth as the Send button.

OAuth 2.0 without the copy-paste

The OAuth 2.0 helper covers the full flow:

• Grant types: authorization code (with or without PKCE, S256 or plain), implicit, password credentials and client credentials.
• Client authentication: send client credentials as a Basic auth header or in the request body.
• Extra parameters: scope, state, audience and resource, plus custom parameters on the authorization request.
• Tokens: give tokens a name, keep several, choose which to use, and see the access token and ID token. The token can be added as a header (with a custom prefix) or to the URL.
• Auto-refresh: when a token has expired and a refresh token exists, it is refreshed automatically before the request is sent.

In the web app, browser-based grants open the provider's login page in a popup and return to https://swastik.codes/oauth/callback, so register that callback URL with your provider. The token request itself is made by the Swastik Codes server, which avoids the CORS errors a browser would hit when calling most token endpoints directly.

Grant type:        Authorization Code (With PKCE)
Auth URL:          https://auth.example.com/oauth2/authorize
Access Token URL:  https://auth.example.com/oauth2/token
Client ID:         {{clientId}}
Scope:             openid profile orders:read
Callback URL:      https://swastik.codes/oauth/callback

Tokens from scripts

When an API uses a custom login, fetch the token in a collection-level pre-request script and store it in a variable:

swc.sendRequest({
  url: swc.environment.get("baseUrl") + "/auth/login",
  method: "POST",
  header: { "Content-Type": "application/json" },
  body: { mode: "raw", raw: JSON.stringify({ email: swc.environment.get("email"), password: swc.environment.get("password") }) }
}, (err, res) => {
  if (!err) swc.environment.set("token", res.json().token);
});

Then use Bearer auth with {{token}} on the collection.

OAuth for MCP servers

Remote MCP servers protected by OAuth 2.1 have a dedicated debugger in the MCP client that runs discovery and dynamic client registration step by step.

How it works

1. Open a request, folder or collection in the app and pick an auth type in the Authorization tab.
2. Fill in credentials, ideally as variables.
3. Send (free account required). For OAuth 2.0, get a token first; it is reused until it expires.

Frequently asked questions

Which OAuth 2.0 callback URL should I register?

For the web app, https://swastik.codes/oauth/callback.

Does the token request go through my browser?

No. The authorization page opens in your browser, but the code-for-token exchange and refreshes are made by the Swastik Codes server, which only connects to public token endpoints.

Can I use client certificates (mTLS) for authentication?

Yes. Add client certificates (PEM or PFX) and custom CA certificates under Settings, Certificates; a certificate is sent for mutual TLS when the request host matches. gRPC and MQTT requests take client certificates in their own settings.

Are Postman auth settings imported?

Yes. Auth configured in Postman collections, folders and requests is imported with the collection.