Auth

Each request has an Auth tab with an Auth type dropdown. The types are:

• Inherit from collection, the default
• No auth
• Bearer token, with a prefix you can change
• Basic auth
• API key, in a header or in the query
• Digest
• AWS Signature V4
• OAuth 2.0

Every field accepts {{variable}}.

Set auth for a whole collection

The Auth button in the collection header sets auth once. Every request that is set to Inherit uses it.

How Codestamp applies it

Codestamp builds the auth header or parameter in its Rust core just before it sends. If you typed a header or parameter with the same name yourself, yours wins. History stores auth as you typed it, with {{variable}} intact, so secrets stay out of History.

Digest and AWS Signature V4

Digest follows RFC 7616 and answers after the server’s 401 challenge. AWS Signature V4 is signed right before sending, after validation.

OAuth 2.0

Three grants are available: authorization code with PKCE, client credentials, and password.

• Authorization code opens the sign-in in a Codestamp window of its own, and that window captures only the redirect to the callback address you set.
• Codestamp stores tokens and refresh tokens encrypted, per request, or per collection when the request inherits.
• It refreshes a token 30 seconds before it expires, and it renews client credentials on its own.
• The endpoints must use HTTPS, except localhost.

Other places auth appears

gRPC requests support Bearer, Basic, API key in a header, and OAuth 2.0. See gRPC requests. On import, Postman Bearer and API key auth become a header or a parameter. Basic becomes a header, or a pre-request script when it uses variables, and auth inherited from a collection or folder is applied. See Import and export.