Connect to the Leadfeeder API with OAuth using Postman

Postman is the quickest way to check that your OAuth application is set up correctly before you write any code. This walkthrough takes you from a new application to a working API call.

Step 1. Create the OAuth application

In Leadfeeder, go to Settings > Company > Developer Access > Applications and click New Application.

Fill in the form as described in How to create and manage an OAuth application, with one addition specific to Postman.

Add this as an Authorized redirect URL:

<https://oauth.pstmn.io/v1/callback>

Select the scopes your requests will need. Save the application, then copy the Client ID and Client Secret into a password manager. The secret is shown in full only once.

Step 2. Set up authorization in Postman

Open the Authorization tab on your request or collection.

Setting	Value
Auth Type	OAuth 2.0
Add authorization data to	Request Header

Under Current Token:

Setting	Value
Token	Available Tokens
Header Prefix	`Bearer`

Step 3. Configure a new token

Still on the Authorization tab, fill in the Configure New Token section.

Setting	Value
Token Name	Any name you will recognise
Grant Type	Authorization Code (With PKCE)
Authorize using browser	Tick the checkbox
Auth URL	`https://api.leadfeeder.com/v1/oauth/authorize`
Access Token URL	`https://api.leadfeeder.com/v1/oauth/token`
Client ID	The Client ID of your OAuth application
Client Secret	The Client Secret of your OAuth application
Code Challenge Method	SHA-256
Code Verifier	Leave empty
Scope	A space separated list of scopes, for example `companies:read lists:read`
State	Any random string
Client Authentication	Send client credentials in body

Step 4. Configure the advanced options

Open the Advanced section below the token settings.

Refresh Token URL

<https://api.leadfeeder.com/v1/oauth/token>

Auth Request: no changes needed.

Token Request

Key	Value	Send in
`grant_type`	`authorization_code`	Request body

Refresh Request

Key	Value	Send in
`client_id`	Your Client ID	Request body
`client_secret`	Your Client Secret	Request body

Step 5. Get the token

Click Get New Access Token. Your default browser opens the Leadfeeder sign-in screen, then the authorization screen showing your application name and the scopes it is asking for.

Approve it, and Postman receives the token.

Step 6. Turn on auto-refresh

Once the token has come through, enable Auto-refresh Token. Postman will renew the access token in the background using the refresh token, so your testing is not interrupted.

Step 7. Make a request

You are ready to call the API. Most endpoints need your account_id as a query parameter.

GET <https://api.leadfeeder.com/v1/companies/{id}?account_id=[YOUR_ACCOUNT_ID]>

Postman adds the Authorization: Bearer ... header for you.

Troubleshooting

The browser shows a redirect URI mismatch. The callback URL in Postman does not match one of the Authorized redirect URLs on your application. Check that https://oauth.pstmn.io/v1/callback is saved on the application, exactly as written.

You get insufficient_scope. The scope the endpoint needs is not on your token. Add it to the application in Leadfeeder, then request a new token so the user can approve it.

You get forbidden. The scope is on the token, but the Leadfeeder user who authorized the application does not have that permission in the platform.

The token stopped working after you rotated the secret. Rotating the Client Secret takes effect immediately. Update the secret in Postman and request a new token.

--

Questions, comments, feedback? Please let us know by contacting our support team via the chat or by sending us an email at support@leadfeeder