OAuth 2.0 Configuration

Overview

Bruno allows you to configure OAuth2 authentication at multiple levels: collection, folder, and request. This guide explains how to set up and use OAuth2 authentication effectively across your API testing workflow.

Setting Up OAuth2

1. Access Settings

   • Collection Level: Open your collection and navigate to Collection Settings > Auth tab
   • Folder Level: Right-click on the folder and select Folder Settings > Auth tab
   • Request Level: Open your request and navigate to Auth tab

2. Configure OAuth2

   • Choose “OAuth 2.0” from the authentication dropdown
   • Select your preferred grant type
   • Fill in the required OAuth2 parameters

Supported Grant Types

Bruno supports three OAuth2 grant types:

• Authorization Code
• Client Credentials
• Password Credentials

Managing Access Tokens

Generating Tokens

1. Configure OAuth2 parameters as per grant type.
2. You can choose where to add this token in the request by selecting the “Add token to” dropdown:
   • Headers
     • Adds the token to the request headers
     • Configure the header prefix (defaults to “Bearer”)
   • URL
     • Adds the token to the request URL
     • Configure the query parameter name (defaults to “access_token”)
3. Click “Get Access Token” to obtain and store the token.

Auto-fetch and Auto-refresh Settings

Bruno provides two important token management features:

• Auto-fetch: When enabled, Bruno will automatically fetch a new token when you try to access a resource and don’t have a valid token. This eliminates the need to manually retrieve a token before making API calls.

• Auto-refresh: When enabled, Bruno will automatically refresh your token using the refresh URL when it expires. This ensures continuous access to protected resources without manual intervention.

These settings can be found in the OAuth2 configuration panel and provide significant convenience for API testing workflows.

Authentication Inheritance

Once you configure OAuth2 at the collection or folder level, you can inherit the authentication at the request level without duplicating the configuration.

How to Inherit Authentication

1. Open your request and navigate to Auth tab
2. Select Inherit from the authentication dropdown

The token will be automatically added to your request according to the inherited configuration.

Inheritance Hierarchy

Bruno follows a specific hierarchy for authentication inheritance:

1. Request-level configuration (highest priority)
2. Folder-level configuration (if no request-level config)
3. Collection-level configuration (if no folder-level config)
4. No authentication (if no configuration at any level)

Using OAuth2 Tokens

Method 1: Collection/Folder Inheritance

When a collection or folder has OAuth2 configured, individual requests can inherit the authentication:

• Open request settings
• Select “Auth” tab
• Choose “Inherit from collection” or “Inherit from folder”
• The token will be automatically added to the request according to your configuration (Headers or URL)

Method 2: Direct Token Reference

You can manually reference OAuth2 tokens in your requests using the variable format {{$oauth2.<tokenId>.access_token}} in headers or query parameters.

Example

As shown in the video above, the Token ID value will be {{$oauth2.credentials.access_token}}

Configuration Comparison