Postman - Not able to send request with client_credentials grant_type

Question

I am trying to get an accessToken from Microsoft Graph API using Postman tool. I am trying it in Authorization tab with Type=oauth2.0, so that I can use this accessToken for subsequent Get,Post requests.

Everything works fine, if the grant_type is "Authorization Code". But when the grant_type is client_credentials, postman throws the below error

error getting access token from client_credentials flow. Could not send request

I have looked at the Network tab in DeveloperTools, it does not submit Client_Id, Client_Secret for client_credentials flow.

Question: How can I get Postman work for client_credentials grant_type scenario?

Am I missing any step here? Please guide me..

Thanks

Answer 1

I'm late to the party on this, but hopefully if someone else looks for this, they can find it, since we ran into the same issue.

The previous two answers (https://stackoverflow.com/a/65708126/6772160 and https://stackoverflow.com/a/50270148/6772160) guided us in the right direction, but we still had to translate this to work properly in Postman:

As Mahmoud mentioned, you can send in the client_id and the client_secret as basic auth: Basic Auth

The main part is handling the grant_type as client_credentials though. To do that, we input:

grant_type=client_credentials in the Body of the request.

Click Body > select x-www-form-urlencoded > key = grant_type and value = client_credentials.

The Body tab should look like this when completed: Body Tab

Hopefully that helps!

Answer 2

Try providing the following details:

Request Type: POST
URL: https://XXXXXXXXXXXXXXXXXXXXXXXX/token?grant_type=client_credentials
Authorization: Basic [client_id]:[client_secret]
Content-Type: application/x-www-form-urlencoded

The output should look like:

{
    "access_token": "90778b6abce64fc124892ce66f7a8ecd",
    "token_type": "Bearer",
    "expires_in": 60,
    "scope": ""
}

Note: Provide [client_id]:[client_secret] as BASE64Encoded.

Answer 3

You should send it as a raw or x-www-form-urlencoded data as in the following example:

Important header >>>> Content-Type: application/x-www-form-urlencoded

var data = "grant_type=client_credentials";

var xhr = new XMLHttpRequest();

xhr.withCredentials = true;

xhr.addEventListener("readystatechange", function() {
  if(this.readyState === 4) {
    console.log(this.responseText);
  }
});

xhr.open("POST", "https://########/oauth/v2/token");
xhr.setRequestHeader("Authorization", "Basic ###############");
xhr.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");

xhr.send(data);