Stop 09 · API DesignTopics · 10/12

Postman

In short

Before any frontend exists, you still need to poke your API: log in, grab the token, call a protected route. Postman turns that into a few clicks instead of a pile of curl commands.

A GUI tool for building, testing and documenting API requests — the standard way developers manually exercise an API during development before a frontend exists.

The blob character tests a scooter engine on a bench with a gauge.

Think of it like this

The mechanic's test bench

A good mechanic doesn't fit an engine into a scooter just to check it. He clamps it on a bench, connects gauges and revs it. Postman is your API's test bench: fire real requests, watch the responses, and save the whole setup for next time.

Watch it happen

Login, save token, call a protected route

Postman

Your API

POST /auth/login

1/5You send a login request with an email and password in the JSON body.

The big ideas

What you need to know

Collections group requests

Save requests in folders by feature. A teammate imports the collection and runs the same calls.

Environments hold variables

Keep baseUrl and tokens in Local, Staging and Prod environments, then switch with one dropdown.

Scripts and tests

Small JavaScript snippets run after a response to check status codes and store values for later requests.

Share, don't screenshot

Export the collection as JSON into your repo, so the whole team tests the same way.

See it in code

Walk through the code

1pm.test("login returns 200", () => {2  pm.response.to.have.status(200);3});4 5pm.test("response has a token", () => {6  const body = pm.response.json();7  pm.expect(body.token).to.be.a("string");8  pm.environment.set("token", body.token);9});

1/3pm.test names a check. This one fails if login didn't return 200.

Paste this into the login request's Scripts tab, under Post-response. Results show in Test Results after you hit Send.

Save yourself the pain

Common mistakes

Oops

Hardcoding http://localhost:3000 and real tokens in every request.

Do this instead

Use {{baseUrl}} and {{token}} from an environment. Switching servers then takes one click.

Oops

Sharing environments that contain real passwords or production keys.

Do this instead

Keep secrets in local values or a vault. Share only collections and placeholder environments.

Your mission

Build a mini collection

~25 min

Quick check

Why write {{baseUrl}} in requests instead of the full URL?

Go deeper

1Build a Postman collection covering every endpoint of an API you've built.
2Use environment variables in Postman to switch between local and production URLs.
3Write a simple automated test script within a Postman request.