Hey @tphilip! This is unfortunately harder than it should be in Postman. The reason it’s tricky is because it has two parts. How it normally works is (assuming you are using the implicit flow for your single-page app):
- You construct an
/authorize
URL and redirect your browser to it - Okta logs the user in, and redirects back to your callback URL with tokens
Postman is great at handling single requests/responses, but it’s tricky to capture the above. You can use an interceptor but to be honest, I’ve never gotten that working properly.
I built a small tool to make this much easier to do: https://oidcdebugger.com
Here’s how to use it:
First, configure your Okta app (temporarily) to allow redirects back to https://oidcdebugger.com/debug
:
Then, configure the request in the debugger tool:
Your Authorize URI should be https://{yourOktaDomain}.com/oauth2/default/v1/authorize
unless you are using a custom Authorization Server.
When you click Send request, you’ll be prompted to log in and be issued an access token. If it doesn’t prompt you, do it in an incognito window.
Hope this helps make it a little easier!