How to use next-auth session token in Insomnia/Postman to test API

[ozeron]

Hello everone,
I want to test POST/PUT request to my API endpoints in Postman/Insomnia.

I get it working with JWT using headers

cookie: __Secure-next-auth.session-token={{ _.jwt }} 

Copy-pasting Cookie object is working, but can I use session.accessToken for API calls?

But what if I want to store my sessions in database, what headers should I use? Can I use access Token from session object?

[Nautman]

Did you find a neat way to do this?

[zomars]

You can try importing postman collection and login using credentials: https://www.postman.com/collections/77398172113023460a76

[Yolo390]

Hi there,

Is there a 'better' way to do it in Insomnia ?

[tommulkins]

What I did was create a Cookie http header with the same string as what the browser would pass. Here's an example logging in with Google OAuth and configuring the cookie in Thunder Client.

[hems]

so after you login on your browser you go to the "Network" tab under "Dev Tools" and get this cookie token manually? is that how it works?

[tommulkins]

so after you login on your browser you go to the "Network" tab under "Dev Tools" and get this cookie token manually? is that how it works?

Exactly. For example, look for an XHR request to session and look in the Request Headers for the Cookie.

[harshal255]

You can try below steps for your api testing using postman. it's worked of me.

Step 1: Check Session Status

1. GET Request: http://localhost:3000/api/auth/session
   • Description: This API call checks if you are logged in. If not logged in, it returns an empty object.

Step 2: Obtain CSRF Token

2. POST Request: http://localhost:3000/api/auth/signin

   • Pre-request Script:

     const jar = pm.cookies.jar();
     console.log("Pre request called...");
     
     pm.globals.set("csrfToken", "Hello World");
     pm.globals.unset("sessionToken");
     
     jar.clear(pm.request.url, function (error) {
       console.log(error);
     });

   • Description: This script sets the csrfToken in the global environment variable and clears the sessionToken you can check that in your postman console.

   • Post-response Script:

     console.log("Post response called...");
     pm.cookies.each(cookie => console.log(cookie));
     let csrfToken = pm.cookies.get("next-auth.csrf-token");
     let csrfTokenValue = csrfToken.split('|')[0];
     
     console.log('csrf token value: ', csrfTokenValue);
     pm.globals.set("csrfToken", csrfTokenValue);

   • Description: This script retrieves the csrfToken from the cookies and sets it in the global environment variable.

Step 3: Log In with Credentials

3. POST Request: http://localhost:3000/api/auth/callback/credentials
   • Body Payload:

     {
       "email":"{{userEmail}}" ,
       "password": "{{userPassword}}",
       "redirect": "false",
       "csrfToken": "{{csrfToken}}",
       "callbackUrl": "http://localhost:3000/",
       "json": "true"
     }

     • take variable from global environment file from postman.
   • Pre-request Script:

     const jar = pm.cookies.jar();
     
     jar.unset(pm.request.url, 'next-auth.session-token', function (error) {
       // error - <Error>
     });

   • Post-response Script:

     pm.cookies.each(cookie => console.log(cookie));
     let sessionTokenValue = pm.cookies.get("next-auth.session-token");
     
     console.log('session token value: ', sessionTokenValue);
     pm.globals.set("sessionToken", sessionTokenValue);

   • Description: This step logs in the user and sets the sessionToken in the global environment variable.

Step 4: Verify Session

4. GET Request: http://localhost:3000/api/auth/session
   • Description: This API call retrieves the user session details, confirming that the user is logged in.

Step 5: Log Out

5. POST Request: http://localhost:3000/api/auth/signout
   • Body Payload:

     {
       "csrfToken": "{{csrfToken}}",
       "callbackUrl": "http://localhost:3000/dashboard",
       "json": "true"
     }

   • Description: This API call logs out the user from the current session.

Checkout this video for more clarify :

https://asset.cloudinary.com/dugkwrefy/6266f043c7092d1d3856bdad6448fa89

[h-behgam]

Thank you for your post.
I need to mention in auth js v5 cookie name changed to (authjs.session-token) and (authjs.csrf-token)