[GH-ISSUE #4954] [feature]: Support extra headers in OAuth 2.0 Authorization Code flow #1870

New issue

Open

opened 2026-03-16 22:11:43 +03:00 by kerem · 3 comments

kerem commented

2026-03-16 22:11:43 +03:00

Owner

Originally created by @ktriple on GitHub (Apr 3, 2025).
Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/4954

Is there an existing issue for this?

I have searched the existing issues

Summary

We should be able to add custom headers to the OAuth 2.0 Authorization Code flow (like Postman supports).

There is a tab named Headers in the pop-up, but I believe these are only send in the actual collection requests.

Why should this be worked on?

When working with (C)IAM services like Auth0, to successfully retrieve a correct JWT, you need to add an Audience header in the GET /authorization request.

Without this, you are not able to get a (JW) token for one of the bigger CIAM services out there.

In Postman it looks like this, simple but effective:

Thanks for looking into this.

Originally created by @ktriple on GitHub (Apr 3, 2025). Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/4954 ### Is there an existing issue for this? - [x] I have searched the existing issues ### Summary We should be able to add custom headers to the OAuth 2.0 Authorization Code flow (like Postman supports). There is a tab named _Headers_ in the pop-up, but I believe these are only send in the actual collection requests. ![Image](https://github.com/user-attachments/assets/44919172-b2c4-43ee-b3d5-a8dd5ee53c2f) ### Why should this be worked on? When working with (C)IAM services like Auth0, to successfully retrieve a correct JWT, you need to add an Audience header in the _GET /authorization_ request. Without this, you are not able to get a (JW) token for one of the bigger CIAM services out there. In Postman it looks like this, simple but effective: <img width="766" alt="Image" src="https://github.com/user-attachments/assets/d689dcee-97af-4feb-a7d0-d49e7fbf7fc7" /> Thanks for looking into this.

kerem added the

feature

label

2026-03-16 22:11:43 +03:00

kerem commented

2026-03-16 22:11:54 +03:00

Author

Owner

@JakobStadlhuber commented on GitHub (Apr 11, 2025):

There are also missing features regarding zitadel compaired to postman

@JakobStadlhuber commented on GitHub (Apr 11, 2025): There are also missing features regarding zitadel compaired to postman <img width="519" alt="Image" src="https://github.com/user-attachments/assets/0ca1ad2e-2b7c-4f69-834a-e89c97cf0bf5" />

kerem commented

2026-03-16 22:11:59 +03:00

Author

Owner

@ktriple commented on GitHub (Apr 14, 2025):

Obvious workaround for Auth0 that I found, you can of course in many cases just add the parameters after the /authorize URL..

/authorize?audience=xxxxxx

This would not work with headers, but for Auth0 this has been my lifesaver so it seems.

@ktriple commented on GitHub (Apr 14, 2025): Obvious workaround for Auth0 that I found, you can of course in many cases just add the parameters after the /authorize URL.. `/authorize?audience=xxxxxx` This would not work with headers, but for Auth0 this has been my lifesaver so it seems.

kerem commented

2026-03-16 22:12:05 +03:00

Author

Owner

@ktriple commented on GitHub (Apr 14, 2025):

I believe I've accidentally created a semi-duplicate. Although there is a difference in the authorization type.

https://github.com/hoppscotch/hoppscotch/issues/4064

@ktriple commented on GitHub (Apr 14, 2025): I believe I've accidentally created a semi-duplicate. Although there is a difference in the authorization type. https://github.com/hoppscotch/hoppscotch/issues/4064

kerem referenced this issue

2026-03-17 01:08:39 +03:00

[PR #1870] [MERGED] feat: disable inputs in realtime and graphql connections when active #3536