# Testing Authorization Code Flow Using Postman - Still Relevant?

**URL:** <https://community.auth0.com/t/testing-authorization-code-flow-using-postman-still-relevant/188978>\
**Category:** Get Help\
**Tags:** sdks-quickstarts, quickstarts-other\
**Created:** [July 9, 2025, 3:47pm UTC](https://community.auth0.com/t/testing-authorization-code-flow-using-postman-still-relevant/188978 "2025-07-09T15:47:44Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![everett.comstock](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/everett.comstock/32/72118_2.png) [@everett.comstock](https://community.auth0.com/u/everett.comstock)\
**Post date:** [July 9, 2025, 3:47pm UTC](https://community.auth0.com/t/testing-authorization-code-flow-using-postman-still-relevant/188978/1 "2025-07-09T15:47:44Z")

</div>

Is this knowledge article still valid?

[https://community.auth0.com/t/testing-authorization-code-flow-using-postman/105024](https://community.auth0.com/t/testing-authorization-code-flow-using-postman/105024)

I’ve reproduced the Postman collection locally and I’m able to successfully invoke all steps, but the **acces\_token** value returned when calling **POST /oauth/token** is present, but its not a valid JWT?

---

<div class="post-metadata">

**Author:** ![gerald.czifra](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/gerald.czifra/32/75301_2.png) [@gerald.czifra](https://community.auth0.com/u/gerald.czifra)\
**Post date:** [July 10, 2025, 10:15pm UTC](https://community.auth0.com/t/testing-authorization-code-flow-using-postman-still-relevant/188978/3 "2025-07-10T22:15:16Z")

</div>

Hi @everett.comstock

Thank you for reaching out!

The usual cause for receiving an invalid JWT ( opaque token ) is that the `audience` parameter was not specified, or not done so correctly. You will need to pass the audience parameter in the token request, specifying the recipient, which should then return the Access Token in JWT format. Documentation for reference :

- [Opaque Versus JWT Access Token](https://community.auth0.com/t/opaque-versus-jwt-access-token/31028)
- [Get Access Tokens](https://auth0.com/docs/secure/tokens/access-tokens/get-access-tokens)

With regards to the Knowledge Article still being up to date, short answer should be yes, but to be safe, we will follow it from scratch and see if we happen to encounter any issues which might need to get addressed. If something comes up, we will update the Knowledge Article as soon as possible. Thank you for checking in with us on the matter!

Hope this helped!  
Gerald

---

<div class="post-metadata">

**Author:** ![everett.comstock](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/everett.comstock/32/72118_2.png) [@everett.comstock](https://community.auth0.com/u/everett.comstock)\
**Post date:** [July 11, 2025, 5:09pm UTC](https://community.auth0.com/t/testing-authorization-code-flow-using-postman-still-relevant/188978/4 "2025-07-11T17:09:31Z")

</div>

@gerald.czifra thanks for the quick reply!

Do you know if using an **authorization\_code** grant type will influence the value associated with the audience parameter? I updated my request to pass the audience value found in our Auth0 management portal, and though I do get a token value back, it is still opaque and not a JWT.

---

<div class="post-metadata">

**Author:** ![everett.comstock](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/everett.comstock/32/72118_2.png) [@everett.comstock](https://community.auth0.com/u/everett.comstock)\
**Post date:** [September 18, 2025, 8:24pm UTC](https://community.auth0.com/t/testing-authorization-code-flow-using-postman-still-relevant/188978/5 "2025-09-18T20:24:38Z")

</div>

I wanted to update this post in case anyone stumbles upon it. I was able to resolve this issue and get the collection from the original article to work by appending the Audience to the /authorize GET request. My authorize GET request now looks like this:

https://{{auth0\_domain}}/authorize?response\_type=code&client\_id={{auth0\_client\_id}}&audience={{auth0\_audience}}&redirect\_uri={{redirect\_uri}}

After adding the audience request parameter I now get back valid JWT.

@gerald.czifra you were correct in your assessment, I just didn’t know where to add the audience in the original collection. If you’re able, I’d recommend updating the request in that article.

Thanks for your assistance!

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [October 2, 2025, 8:25pm UTC](https://community.auth0.com/t/testing-authorization-code-flow-using-postman-still-relevant/188978/6 "2025-10-02T20:25:36Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.