{
  "id": 5665163,
  "title": "Postman for API Work: Collections, Environment Variables, Secrets, Auth, and Tests",
  "url": "https://urgent.news/2026/09/04/postman-for-api-work-collections-environment-variables-secrets-auth",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-04T23:08:24.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/manoharij/postman-for-api-work-collections-environment-variables-secrets-auth-and-tests-23ob"
  },
  "original_language": "en",
  "account": "Postman is a popular tool that people frequently use without fully understanding its capabilities. When working with APIs, many developers simply copy and paste URLs, hardcode tokens directly into headers, send the request, and check the response manually. This post aims to demonstrate how to use Postman effectively with the Product API from previous CRUD and Swagger examples.\n\nA Collection in Postman is a named folder of related requests, grouping all endpoints for one API together. This keeps everything organized, similar to a filing cabinet drawer labeled \"Products API\" with individual folders for each request type. Each request within a Collection stores its method, URL, headers, body, and any tests written for it. The collection remains reusable and shareable with anyone who has access to it.\n\nEnvironment Variables allow you to store and reference values like baseUrl or apiKey using double curly brace syntax. By switching the active environment, you can change what every request in the collection points to without editing individual requests. This works similarly to a universal remote's device selector – the same commands (requests) work with different devices (environments).\n\nSecrets should never be hardcoded into requests. Instead, store them as secret-type variables in an Environment. These variables are masked in the UI, excluded from Postman's sync and export features, and reduce the risk of exposing real keys in screen recordings or shared workspaces.\n\nPostman's Authorization tab simplifies handling authentication schemes like Bearer Token, API Key, Basic Auth, and OAuth 2.0. Instead of manually typing headers or encoding passwords, Postman generates the correct header automatically based on the selected scheme. You can set auth once at the Collection level, and every request inside inherits it automatically, unless a specific request overrides it.\n\nWhen building a real request, define the URL, headers, and body as needed. In the example, a POST request to create a product uses the specified URL, Content-Type header, and JSON body containing product details. Postman sends this request, which then maps to the CreateProductDto and applies validation attributes before invoking the action method.\n\nIt's crucial to check various status codes when testing API behavior. While 200 OK is the default happy-path check, you should also test 404 Not Found, 400 Bad Request, 401 Unauthorized, 403 Forbidden, 201 Created, and 204 No Content. These tests ensure the API behaves as expected in different scenarios, validating successful operations, error handling, authentication, and authorization.",
  "summary": "Postman is the tool most people use constantly and never actually learn properly, pasting URLs into a blank request, hardcoding a token directly into a header, clicking Send and eyeballing the response. This post covers it the way it's actually meant to be used, with the Product API from the earlier CRUD and Swagger posts as the working example throughout. Collections and Requests A Collection is…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}