How to get tokens to test our APIs from Postman?

[rueben.tiow]

Hi @xiaonan.zhang,

Thanks for following up.

For testing your APIs in Postman, you will need to pass an audience parameter in your login request. This is intended to create a JWT access token to be used against your API. For example:

auth0.authorize({
    scope: 'openid profile email', // Specify the desired scopes
    audience: 'your-api-audience', // Specify the API audience
    // Add any additional parameters as needed
  })

@xiaonan.zhang

Our backend server is only for validating tokens so no login actions performed directly on it. Do you recommend to always set the audience to avoid using opaque tokens based on the above?

Yes, if you intend to use the token in the future against your API. Let me also add that you can get most of the information found in your opaque access token as you do in your JWT access token. If there are any attributes missing, you could always append them to your JWT access token as custom claims.

See Adding custom claims to tokens.

@xiaonan.zhang

But the Auth0 “Native” type application does not support Resource Owner Password grant flow.

You will need to use the Authorization Code flow or the Client Credentials flow.

Thanks,
Rueben