I think Postman can be configured to use the Authorization Code grant - see here for additional details. But if you’re using it to get an Access Token, you’re not really testing the performance of the SPA; you’re simply testing the performance of your API…and the performance of Auth0 