[GH-ISSUE #337] Feature Request: Support OAuth2/OIDC #124

New issue

Closed

opened 2026-03-16 13:35:01 +03:00 by kerem · 2 comments

kerem commented

2026-03-16 13:35:01 +03:00

Owner

Originally created by @x2764tech on GitHub (Nov 25, 2019).
Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/337

Originally assigned to: @reefqi037 on GitHub.

Is your feature request related to a problem? Please describe.
Currently, Postwoman supports Bearer Token authentication, but the process of obtaining a token for OAuth2 is non-trivial for any real-life APIs.

Describe the solution you'd like
In an ideal world, Postwoman would support OIDC for endpoint discovery, and Code Grant Types with PCKE (sorry, I'm not 100% sure on the correct terminology as different providers end up relabelling these this - see KeyCloak and IdentityServer4 for examples). It would also be great if there was support for Refresh Tokens, and JWT token introspection to support this.
The gold standard would probably also support OIDC Dynamic Client Registration, but I'm not sure how widly this is supported.
In addition, support for OIDC Front Channel Logout would be amazing.

At a minimum, OAuth2 authentication with Implicit Grants would support my use case (internal APIs), but will probably not support public APIs from Google or Facebook.

Describe alternatives you've considered
Postman has support for OAuth2 with Code, Password and Client Credential grant types, but it's annoying to use as:

Only the last settings are remembered, and so overwritten if you have to change them. If you're authenticating against different endpoints or with different credentials, this quick becomes unmanageable.
It doesn't support Refresh Tokens out of the box, so, for real-life APIs, you're left manually refreshing tokens all the time.

Additional context

There's probably security implications of allowing Postwoman.io as a valid redirect_url for OAuth2 secured apps, but I don't really feel qualified to discuss this.

Originally created by @x2764tech on GitHub (Nov 25, 2019). Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/337 Originally assigned to: @reefqi037 on GitHub. **Is your feature request related to a problem? Please describe.** Currently, Postwoman supports Bearer Token authentication, but [the process of obtaining a token for OAuth2 is non-trivial for any real-life APIs](https://www.oauth.com/oauth2-servers/access-tokens/authorization-code-request/). **Describe the solution you'd like** In an ideal world, Postwoman would support OIDC for endpoint discovery, and Code Grant Types with PCKE (sorry, I'm not 100% sure on the correct terminology as different providers end up relabelling these this - see KeyCloak and IdentityServer4 for examples). It would also be great if there was support for Refresh Tokens, and JWT token introspection to support this. The gold standard would probably also support OIDC Dynamic Client Registration, but I'm not sure how widly this is supported. In addition, support for [OIDC Front Channel Logout](https://openid.net/specs/openid-connect-frontchannel-1_0.html) would be amazing. At a minimum, OAuth2 authentication with Implicit Grants would support my use case (internal APIs), but will probably not support public APIs from Google or Facebook. **Describe alternatives you've considered** Postman has [support for OAuth2 with Code, Password and Client Credential grant types](https://learning.getpostman.com/docs/postman/sending-api-requests/authorization/#oauth-20), but it's annoying to use as: * Only the last settings are remembered, and so overwritten if you have to change them. If you're authenticating against different endpoints or with different credentials, this quick becomes unmanageable. * It doesn't support Refresh Tokens out of the box, so, for real-life APIs, you're left manually refreshing tokens all the time. **Additional context** There's probably security implications of allowing Postwoman.io as a valid redirect_url for OAuth2 secured apps, but I don't really feel qualified to discuss this.

kerem

2026-03-16 13:35:01 +03:00

closed this issue
added the
help wanted

feature

good first issue

discussion
labels

kerem commented

2026-03-16 13:35:17 +03:00

Author

Owner

@liyasthomas commented on GitHub (Nov 25, 2019):

Will discuss about it's implementations and let you know.

@liyasthomas commented on GitHub (Nov 25, 2019): Will discuss about it's implementations and let you know.

kerem commented

2026-03-16 13:35:22 +03:00

Author

Owner

@reefqi037 commented on GitHub (Jan 6, 2020):

Hi 👋 I would like to help with this issue.

Currently, I'm trying to implement additional features to help the process of getting OAuth2 Access Token directly from Postwoman.

There are a 4 types of OAuth 2.0 flows to retrieve Access Token, but since Postwoman is a web-based SPA, the recommended way in term of security is Authorization Code Grant Flow with PKCE.

Therefore, Postwoman should only support this grant type only for the time being ( other grant type can be considered once native version is released ).

Additionally, user have to register https://postwoman.io ( or http://localhost:3000/ ) as the callback URL in the Auth Server beforehand ( which is a bit troublesome though for some users... ).

Finally, here are some of the features that I am trying to add too:

Automatic configuration using OpenID Connect Discovery (support manual configuration too). ✅
Access token management (reuse access tokens or delete them)
Access token request management (reuse token request endpoints or delete them)

@reefqi037 commented on GitHub (Jan 6, 2020): Hi 👋 I would like to help with this issue. Currently, I'm trying to implement additional features to help the process of getting OAuth2 Access Token directly from Postwoman. There are a 4 types of [OAuth 2.0 flows](https://medium.com/@darutk/diagrams-and-movies-of-all-the-oauth-2-0-flows-194f3c3ade85) to retrieve Access Token, but since Postwoman is a web-based SPA, the recommended way in term of security is [Authorization Code Grant Flow with PKCE](https://tools.ietf.org/html/draft-parecki-oauth-browser-based-apps-02#section-7). Therefore, Postwoman should only support this grant type **only** for the time being ( other grant type can be considered once native version is released ). Additionally, user have to register https://postwoman.io ( or http://localhost:3000/ ) as the callback URL in the Auth Server beforehand ( which is a bit troublesome though for some users... ). Finally, here are some of the features that I am trying to add too: 1. Automatic configuration using OpenID Connect Discovery (support manual configuration too). ✅ 2. Access token management (reuse access tokens or delete them) 3. Access token request management (reuse token request endpoints or delete them)