You can request tokens for your own and third-party APIs. Below are the steps to generate the id and access tokens using Postman.

See also the docs about connecting to Kinde’s API

1. In Kinde, go to Settings > Environment > APIs.

2. Select Add API.

3. Give the API a name, and a value for Audience. Note that these values cannot be changed later.

4. Select Save.

5. On the API card, select View Details.

   

6. Select Applications, then switch on the application you want to associate with this API.

   

7. View the details of the application again. Settings > Environment > APIs > View details.

   

8. In the Allowed callback URLs section, add the Postman callback URL, https://oauth.pstmn.io/v1/callback as a separate entry on a new line.

9. Set yourAuth URL as: https://testdomain.kinde.com/oauth2/auth?&prompt=login

   • testdomain.kinde.com is the domain
   • prompt=login forces asking for user credentials on every sign in, to disable SSO.

10. In Token request, set your audience

    • set key as audience
    • set value as https://api.apiaudience.net - the value we added when we created the API (See step 2).
    • set send in to request body

11. In Postman, create a new request.

12. Go to the Authorization tab, and complete details as follows:

    • Grant Type: Authorization Code (With PKCE).
    • Tick the Authorize using browser checkbox.
    • The Auth URL should be the one crafted at step 9.
    • The Access Token URL should be https://<your_kinde_domain>/oauth/token , e.g. https://testdomain.kinde.com/oauth2/token.
    • The Client ID should be the client ID of the application the API is associated with. In the example above, the Client ID of the Frontend App would be used.
    • If you want to also get back an ID Token, set the value of Scope to openid.
    • Set the value of the State field to a random value.
    • Click Get New Access Token.

    

    Below are screenshots of the auth flow and the 2 tokens you will be receiving as a result.

    The ID token contains the aud claim for 2 audiences, one for the application ID, the other one is for the issuing party.

    The Access token contains the audclaim for the requested (intended) audience to authenticate the API. azp claim represents the application client_id you are using to issue the token.