# Postman Endpoint authentication

**URL:** <https://forums.losant.com/t/postman-endpoint-authentication/3109>\
**Category:** Help\
**Tags:** experience\
**Created:** [July 8, 2020, 5:18pm UTC](https://forums.losant.com/t/postman-endpoint-authentication/3109 "2020-07-08T17:18:36Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![Lars\_Andersson](https://avatars.discourse-cdn.com/v4/letter/l/f05b48/32.png) [@Lars\_Andersson](https://forums.losant.com/u/Lars_Andersson)\
**Post date:** [July 8, 2020, 5:18pm UTC](https://forums.losant.com/t/postman-endpoint-authentication/3109/1 "2020-07-08T17:18:37Z")

</div>

I do I authenticate with an experience endpoint using Postman?

---

<div class="post-metadata">

**Author:** ![Heath](https://sea1.discourse-cdn.com/flex015/user_avatar/forums.losant.com/heath/32/3036_2.png) [@Heath](https://forums.losant.com/u/Heath)\
**Post date:** [July 8, 2020, 7:08pm UTC](https://forums.losant.com/t/postman-endpoint-authentication/3109/3 "2020-07-08T19:08:48Z")

</div>

Hey @Lars_Andersson,

In Postman, you can send a post request to an experience with the following URL (you’ll replace APPID with your experience app id): [APPID.onlosant.com/myCustomAuthEndpoint](http://APPID.onlosant.com/myCustomAuthEndpoint)

You can either send the authentication token in the URL, or in the body of the request. The [User Authentication](https://docs.losant.com/guides/building-an-experience-api/user-authentication/) section of the How to Build an Experience API guide is a great resource for building the endpoint itself.

You can check out [Passing Authorization Tokens](https://docs.losant.com/experiences/endpoints/#passing-authorization-tokens) in our docs. But below I’ve included an image for each of the options I gave above.

 ![image](https://us1.discourse-cdn.com/flex015/uploads/getstructure/original/2X/c/c37b74f0f772d7aa28af10ff4e0bcd8c7b9f74af.png)  
 ![image](https://us1.discourse-cdn.com/flex015/uploads/getstructure/original/2X/c/c4c9b491d6e896c425ef2d3f3326ef7c36d66f16.png)

For these to work, you will need to update the authentication node in your workflow to accept the values you send since they are in specific places in the payload.

Thank you,  
Heath

---

<div class="post-metadata">

**Author:** ![Lars\_Andersson](https://avatars.discourse-cdn.com/v4/letter/l/f05b48/32.png) [@Lars\_Andersson](https://forums.losant.com/u/Lars_Andersson)\
**Post date:** [July 8, 2020, 8:59pm UTC](https://forums.losant.com/t/postman-endpoint-authentication/3109/4 "2020-07-08T20:59:34Z")

</div>

Thanks, I got a few steps further.

When looking at the returned data in Postman from data,responseuser, I see a time value for “tokenCutoff”. Should that match based on the TTL time I enter in Max-Age for Token generation in the Authentication Node?

---

<div class="post-metadata">

**Author:** ![Heath](https://sea1.discourse-cdn.com/flex015/user_avatar/forums.losant.com/heath/32/3036_2.png) [@Heath](https://forums.losant.com/u/Heath)\
**Post date:** [July 9, 2020, 2:37pm UTC](https://forums.losant.com/t/postman-endpoint-authentication/3109/5 "2020-07-09T14:37:17Z")

</div>

Hey @Lars_Andersson

You can find more information about the auth token in the `authInfo` object of the response. `tokenCutoff` is in the `user` object.

Here’s what the `authInfo` object looks like:

```auto
"authInfo": {
    "issuedAt": "2020-07-09T14:21:07.000Z",
    "expiresAt": "2020-07-09T14:26:07.000Z"
}

```

There you can see the time at which the token will expire.

Thank you,  
Heath

---

<div class="post-metadata">

**Author:** ![Lars\_Andersson](https://avatars.discourse-cdn.com/v4/letter/l/f05b48/32.png) [@Lars\_Andersson](https://forums.losant.com/u/Lars_Andersson)\
**Post date:** [July 9, 2020, 8:27pm UTC](https://forums.losant.com/t/postman-endpoint-authentication/3109/7 "2020-07-09T20:27:29Z")

</div>

I can not find that in the object of response.

The only authInfo I can find is under experience and it shows null.

---

<div class="post-metadata">

**Author:** ![Heath](https://sea1.discourse-cdn.com/flex015/user_avatar/forums.losant.com/heath/32/3036_2.png) [@Heath](https://forums.losant.com/u/Heath)\
**Post date:** [July 10, 2020, 2:54pm UTC](https://forums.losant.com/t/postman-endpoint-authentication/3109/9 "2020-07-10T14:54:12Z")

</div>

Hey @Lars_Andersson,

I’m looking into reproducing this on my end. I’ll update this thread when I have a better answer for you!

Thank you,  
Heath

---

<div class="post-metadata">

**Author:** ![Heath](https://sea1.discourse-cdn.com/flex015/user_avatar/forums.losant.com/heath/32/3036_2.png) [@Heath](https://forums.losant.com/u/Heath)\
**Post date:** [July 13, 2020, 7:30pm UTC](https://forums.losant.com/t/postman-endpoint-authentication/3109/10 "2020-07-13T19:30:04Z")

</div>

@Lars_Andersson,

I want to be sure I’m approaching your question correctly, could you please send me the workflow you’re sending the request to? Either a screenshot or a zip file are fine.

Thank you so much,  
Heath

---

<div class="post-metadata">

**Author:** ![Lars\_Andersson](https://avatars.discourse-cdn.com/v4/letter/l/f05b48/32.png) [@Lars\_Andersson](https://forums.losant.com/u/Lars_Andersson)\
**Post date:** [July 13, 2020, 7:43pm UTC](https://forums.losant.com/t/postman-endpoint-authentication/3109/13 "2020-07-13T19:43:30Z")

</div>

[get-apitest-develop.zip](https://forums.losant.com/uploads/short-url/jPHlwjbLkWVlITMqkrIb544CtoO.zip) (1.1 KB)

---

<div class="post-metadata">

**Author:** ![Heath](https://sea1.discourse-cdn.com/flex015/user_avatar/forums.losant.com/heath/32/3036_2.png) [@Heath](https://forums.losant.com/u/Heath)\
**Post date:** [July 13, 2020, 8:41pm UTC](https://forums.losant.com/t/postman-endpoint-authentication/3109/14 "2020-07-13T20:41:47Z")

</div>

@Lars_Andersson,

I notice workflow is named GET and the first trigger node in the workflow is configured for a post request, are you making the correct HTTP request type when triggering this workflow?

Also, I was able to get this working on my end. The only thing I needed to change was to turn `{{data.body.data.email}}` into `{{data.body.email}}`. This is because of the structure I’m sending in Postman, it’s not a nested object. Here’s what that looks like:

 ![image](https://us1.discourse-cdn.com/flex015/uploads/getstructure/original/2X/7/7d9a317e0d4b229f0e4fb2ae0e9f26e59e547d4d.png)  
 ![image](https://us1.discourse-cdn.com/flex015/uploads/getstructure/original/2X/9/9591b4ff1f06df1fcfd382343e279055b3740e97.png)

Could you send me the format of the payload you’re sending in Postman OR a screenshot of your workflow debug when this workflow is triggered?

Thanks,  
Heath

---

<div class="post-metadata">

**Author:** ![Lars\_Andersson](https://avatars.discourse-cdn.com/v4/letter/l/f05b48/32.png) [@Lars\_Andersson](https://forums.losant.com/u/Lars_Andersson)\
**Post date:** [July 13, 2020, 8:58pm UTC](https://forums.losant.com/t/postman-endpoint-authentication/3109/16 "2020-07-13T20:58:39Z")

</div>

I was using POST from Postman…

It was authenticating, but I couldn’t see any authInfo returned.

---

<div class="post-metadata">

**Author:** ![Heath](https://sea1.discourse-cdn.com/flex015/user_avatar/forums.losant.com/heath/32/3036_2.png) [@Heath](https://forums.losant.com/u/Heath)\
**Post date:** [July 13, 2020, 9:13pm UTC](https://forums.losant.com/t/postman-endpoint-authentication/3109/17 "2020-07-13T21:13:22Z")

</div>

@Lars_Andersson,

In your workflow, on successful authentication, you’re sending your own body data.

 ![image](https://us1.discourse-cdn.com/flex015/uploads/getstructure/original/2X/d/d6c48d4c568d71a08a9308efe7d85a0d02423e85.png)

Because you have configured this to send specific data, you will need to include any values you would like to send in the response body. To send the whole response, you can replace what you have in the Response Body Template with `{{.}}`. If you would like to additionally send the `authInfo` with what you have now, you will need to include it as another JSON key and value.

Heath