Using Postman Pre-request Scripts to Dynamically Sign API Requests

The Problem: Static Auth Headers Cause Flaky Tests

When testing APIs that require a timestamp‑based nonce or an HMAC signature, hard‑coding those values in a request leads to failures as soon as the server rejects stale data. Engineers often resort to manually updating environments or writing external scripts, which adds friction and breaks the self‑contained nature of a Postman collection.

Why Pre‑request Scripts Help

Pre‑request scripts run JavaScript in Postman’s sandbox just before a request is sent. They can read and write environment variables, generate timestamps, compute cryptographic hashes, and modify headers or query parameters on the fly. Because the script is attached to the request (or a folder/collection), the logic travels with the collection and executes consistently across runs.

Worked Example: Adding a Timestamp and HMAC Signature

1. Create a new GET request to https://api.example.com/resource.
2. In the request’s Pre‑request Script tab, paste the following code:

// Generate a UTC timestamp in milliseconds
const timestamp = Date.now().toString();
pm.environment.set('req_timestamp', timestamp);

// Example secret – in practice retrieve from a secure store
const secret = pm.environment.get('hmac_secret') || 'dev-secret';

// Compute HMAC‑SHA256 of the timestamp
const crypto = require('crypto');
const hmac = crypto.createHmac('sha256', secret).update(timestamp).digest('hex');
pm.environment.set('req_signature', hmac);

// Add headers that the API expects
pm.request.headers.add({
  key: 'X-Timestamp',
  value: timestamp
});
pm.request.headers.add({
  key: 'X-Signature',
  value: hmac
});

1. In the request URL or headers, reference the variables:
   https://api.example.com/resource?ts={{req_timestamp}}
   or set an Authorization header to HMAC {{req_signature}}.
2. Save the request.

Trade‑offs and Limitations

While powerful, pre‑request scripts add a small amount of latency because the JavaScript runs before each network call. Complex logic—especially loops, large crypto operations, or attempts to import external npm modules—can exceed the sandbox’s execution time limits and cause the request to be aborted. Debugging relies on the Postman Console; errors thrown in the script prevent the request from being sent, which is useful for catching mistakes but can be confusing if you expect the request to proceed.

How to Verify the Result

1. Open the Postman Console (View → Show Postman Console).
2. Click Send on the request.
3. In the console, look for the console.log statements you may have added (e.g., console.log('timestamp', timestamp)) to confirm the values were generated.
4. Still in the console, select the request entry and inspect the generated headers; you should see X-Timestamp and X-Signature with values that change on each run.

If the request fails with a 401 or similar, check the console for any script errors; the request will not be sent if an exception is thrown.

Closing: When to Use This Approach

Pre‑request scripts are ideal for lightweight, deterministic transformations such as timestamps, nonces, or simple hash‑based signatures that keep your API tests self‑contained and repeatable. Avoid moving heavy computation or asynchronous calls into the script; instead, handle those outside Postman and pass the results via environment variables or data files. By keeping the script focused and verifying output in the Postman Console, you gain reliable dynamic request customization without sacrificing collection portability.