Updating Access Tokens in Postman

 Microsoft recently changed their rules regarding Azure issued token expirations.  Tokens will now expire after an hour and it appears there's very little you can do about that.  So, what do you do?  You need to make use of the refresh token.  A refresh token allows you go generate a new token and will have a much longer expiration time - Azure tokens have a three month lifespan by default.  When you generate a new token, you get a new refresh token also.  This means that while your token only lasts an hour, you can go as long as three months before you need to actually go through the token request process again.  As long as you use your refresh token before it expires (and it's not revoked), your access will effectively never expire.

From a security perspective, this is a good thing as it limits the damage that a misplaced token can do since a token can be revoked in no more than an hour.  From a development perspective, it means that applications using these tokens will now have to do a little more work.  It also means that Postman's built in OAuth handling will require you to generate an Azure token again when it expires as it does not have refresh capability.  With Azure, this means logging in to a Microsoft account and you may not want to go through that (also, it's good to be able to test this process in Postman since you will need to do it in your application).  To automate the use of refresh variables in Postman, you have to create a separate request and any token you receive will need to make it back to the requests using it.  Variables are a great way to do this but you still have to update the variable from the refresh response.

Here's how you do it.

This process assumes that you have all of the information needed to generate your token and already have a refresh token, which you can get using Postman's OAuth token manager.

The first thing you need to do is add some token variables to your collection.  Edit the collection and click on the variables tab to create them.

You will need two variables - one for the refresh token and another for the token itself.  You want to store the refresh token after each refresh so that you get maximum use out of it.  Once you have that, you can setup a refresh request.  This may be different depending on the API you're using.

You also need a script to update the variables.  This can be found under Tests.

Once you have this in place, you just need to setup your requests to use the token for authentication.

You should now be able to make API calls with your OAuth2 credentials and minimal effort.