Collections, folders and authorization

A collection is a group of requests for one API, with folders inside it. It is also where shared settings live: variables, authorization and scripts set on the collection apply to every request inside, so you set them once.

Make a collection

1. In Collections in the left sidebar, click + and name it Shop API.
2. Right-click the collection and choose Add folder: make Auth and Orders.
3. Add requests to each folder with Add request, or drag existing requests in.

Already have an API description? Import at the top reads OpenAPI (Swagger), Postman, Insomnia, HAR and cURL, and builds the collection for you. If you have the source code, the swc CLI can read the routes straight from it.

Set authorization once

Open the collection (right-click → Open overview) and go to the Authorization tab. Choose the scheme your API uses (for example Bearer Token) and set the token to a variable: {{token}}.

Now every request whose own Authorization tab says Inherit auth from parent sends that header. A folder can override it (say, an Admin folder with a different token), and a single request can turn it off with No Auth.

Swastik Codes supports API Key, Bearer, Basic, Digest, OAuth 1.0, OAuth 2.0 (with automatic token refresh), JWT, AWS Signature, Hawk, NTLM, Akamai EdgeGrid and ASAP.

Get the token automatically

Most APIs give you a token when you sign in. Instead of copying it by hand:

1. Create a request in Auth called Log in: POST {{baseUrl}}/login with your email and password in the JSON body (use variables for them, with your password as a current value).
2. Open its Scripts tab, choose Post-response, and add:

const body = swc.response.json();
swc.environment.set('token', body.token);

3. Send Log in once. The token lands in the active environment and every other request starts using it.

swc. and Postman's pm. mean the same thing in scripts, so scripts copied from Postman work unchanged.

Write things down

Each request and folder has a Docs tab for a description in Markdown. Descriptions show up in published documentation (lesson 16), so a sentence or two per endpoint pays off later.

What you learned

• Collections hold requests, folders and shared settings; set auth on the collection and let requests inherit it.
• A short post-response script can store a login token so you never copy one by hand.

Next: make Swastik Codes check the responses for you with tests.