Permanent Tokens and OAuth Apps in Bynder - how to use them in Postman

Summary

You can connect and authenticate Bynder API requests using Postman to test and validate integration workflows. This article provides detailed instructions for setting up authorization in Postman using either Permanent Tokens or OAuth 2.0 Apps (Client Credentials or Authorization Code with Refresh Token).

Why?

Configuring Postman with Bynder authentication credentials allows technical teams to safely test API endpoints, inspect responses, and debug integration paths before writing production code. This setup ensures secure access management while accelerating development timelines.

How?

Use a Permanent Token in Postman

  1. Create the Permanent Token in Bynder. An Administrator must complete this step.
  2. Save the token value to a secure location immediately. For security reasons, you cannot view the full token again.
  3. Open Postman and navigate to the specific API call you want to run.
  4. Go to the Authorization (1) tab.
  5. In the Auth Type (2) dropdown menu, select Bearer Token (3).
  6. Paste the Permanent Token value copied from Bynder into the token field.

  7. Click Save (4).

Use an OAuth App with Client Credentials Grant Type in Postman

Note: Setting up an OAuth App with a Client Credentials grant type is highly recommended as it provides the most straightforward configuration process.

  1. Create the OAuth App in Bynder with a Client Credentials - Assigned User Grant Type.
  2. Copy the generated Client ID and Client Secret to a secure location. You cannot view the full Client Secret again and must regenerate it if lost.
  3. Open Postman, go to the API call you want to run, and update the following settings:
  4. Change the Auth Type dropdown to OAuth 2.0.
    1. Change the Add Authorization Data to menu to Authorization Headers.
    2. Change the Grant Type menu to Client Credentials.
    3. In the Access Token URL field, enter https://{{your dam portal url}}/v6/authentication/oauth2/token. Replace {{your dam portal URL}} with the base domain of your Bynder portal (for example: yourcompany.bynder.com).
    4. Enter the Client ID from Bynder into the Client ID field in Postman.
    5. Enter the Client Secret from Bynder into the Client Secret field in Postman.
    6. Change the Client Authentication to Send as Basic Auth header.
    7. Click the Save button on the top of the page to save all of these variables.

    8. Click the Get New Access Token button at the bottom of the page to open a popup window (see the 2nd screenshot below).

  5. Verify the Authentication Complete message in the popup window, then click the Proceed button in the lower-right corner. 

  6. Click the Use Token button to apply this token to your authentication configuration. 

 

Note: This token has a 1-hour validity window. Once that hour has passed, the token expires and you may receive a 401 - Unauthorized error on subsequent API calls. If this occurs, return to the Authorization tab and click the Get New Access Token button at the bottom of the page. 

Use an OAuth App with an Authorization Code and Refresh Token Grant Type

  1. Create an OAuth App with an Authorization Code + Refresh Token Grant Type in Bynder.

    1. When configuring the Authorization redirect URIs in the Bynder OAuth App, add the callback URI provided by Postman  (if you’re using this Oauth App for Authorization in Postman). This is available in the section laid out in the screenshot/instructions below, but it should look something like the following: [https://oauth.pstmn.io/v1/callback](https://oauth.pstmn.io/v1/callback)). Add any other callback URLs you may need now or in the future.

Set up and use the Authorization Code Client Credentials in Postman

Open Postman and go to the API call you want to configure.

  1. Go to the Authorization tab and update the following fields:
  2. Change the Auth Type menu to OAuth 2.0.
  3. Ensure the Header Prefix is set to Bearer.
  4. Change the Grant Type menu to Authorization Code.
  5. Make sure that the default value that is in the Callback URL field is listed in the Bynder Oauth App as an option in the Authorization redirect URIs section (see screenshot above). This should look something like: *<https://oauth.pstmn.io/v1/callback*>.
  6. Ensure the Authorize using browser checkbox is selected.
  7. Fill in the Auth URL field with your portal’s auth URL. This is broken down in the API Documentation in the Authorize Application call, but the format will be: https://{{YOUR PORTAL BASE DOMAIN}}/v6/authentication/oauth2/auth. Replace {{YOUR PORTAL BASE DOMAIN}} with your actual Bynder portal URL.
  8. Fill in the Access Token URL field using the format: https://{{YOUR PORTAL BASE DOMAIN}}/v6/authentication/oauth2/token. Replace {{YOUR PORTAL BASE DOMAIN}} with your actual Bynder portal URL. See API Documentation in the Authorize Application for more information.
  9. Add the Client ID you obtained from Bynder into the Client ID field.
  10. Add the Client Secret you obtained from Bynder into the Client Secret field.
  11. In the Scope field, add the scopes you want the token to hold. You must add offline to the beginning of the listed scopes. For example, for read and write access to assets via the API, enter: offline asset:read asset:write.
  12. In the State field, enter the word State.
  13. In the Client Authentication field, set the menu option to Send as Basic Auth header.
  14. In the Refresh Token URL field, add the refresh token URL using the format: https://{{YOUR PORTAL BASE DOMAIN}}/v6/authentication/oauth2/token. Replace {{YOUR PORTAL BASE DOMAIN}} with your actual Bynder portal URL.

  15. In the Auth Request section, add a Key-Value pair where Key is response_type =code. This should look like this in Postman (this is needed as part of the authorization URL). 

  16. Click Save on the top of the page to save all parameters.
  17. Click the Get New Access Token button at the bottom of the page.
  18. Once you click the Get New Access Token button, you will be redirected to your Bynder Login page. Log in with the user profile that you want to tie to the token.
  19. Click Confirm on the OAuth Authorization screen to grant access to your Bynder portal.
  20. After clicking Confirm, this should lead you back to Postman and you should see the below not in your browser window. Make sure that pop-up blockers are off on your browser or this could prevent this from happening.

  21. In the Postman popup window, click the Proceed button.

  22. Click the Use Token button to apply the token. You can now execute calls to the Bynder API. See the screenshot below. 

    Related Articles

    How To Create Permanent API Tokens For Integrations

    How To Enable And Use Okta SCIM With Bynder

    How To Create And Manage OAuth 2.0 Apps to Provide Access to Bynder API

 

Updated