Skip to main content
Configuring Postman with your OAuth 2.0 details allow you to test Pleo API endpoints, whilst leaving the token lifecycle management to Postman.

Prerequisites

  • You have completed Pleo’s registration process
  • You have received your Client ID and Client Secret from Pleo
  • You have logged into Postman and have created a collection

Steps

1. Configure a new token

  1. Open your Postman collection
  2. Click the Authorization tab
  3. Select OAuth 2.0 as the Auth Type
Pleo video coming soon.
  1. Scroll to the Configure New Token section
  2. Provide the following configuration:
ParameterConfiguration
Grant typeAuthorization Code (With PKCE)
Callback URLThe Postman redirect endpoint URIs you registered
Auth URL{AUTHORIZATION_SERVER_URL}/oauth/authorize
Access Token URL{AUTHORIZATION_SERVER_URL}/oauth/token
Client IDClient ID you received after registration
Client SecretClient Secret you received after registration
Code Challenge MethodSHA-256
Code VerifierLeave blank, or provide a valid PKCE code verifier.
ScopeEnter space-delimited list of API scopes that you registered
Client AuthenticationSend as Basic Auth Header
We recommend using Postman environment variables to store the authorisation server base URL and client credentials. This allows you to quickly switch between staging and production environments.
Pleo video coming soon.

2. Get a new Access Token

  1. Scroll down and click Get New Access Token.
Pleo video coming soon.
  1. A new browser window opens and redirects you to Pleo’s authorisation server
  2. Complete the authorisation process and grant access using your staging credentials
  3. After authorisation, you are redirected back to Postman
  4. Click Use Token
Pleo video coming soon.
Postman can automatically obtain new access tokens when existing tokens expire. Ensure the Auto-refresh Token toggle is enabled.

Result

  • Postman is configured to authenticate with Pleo using OAuth 2.0
  • You can make authenticated requests to Pleo’s staging APIs
  • Postman manages the access token lifecycle automatically

What Comes Next?


this how-to is part of: