Hi,

Source: this document.

Postman, by default, strips the Authorization header when it follows a redirect to a different host. This is a security feature designed to prevent your sensitive credentials from being sent to an untrusted third-party server.

When a server responds with a redirect status code (like a 301 or 302), it's telling the client to make a new request to a different URL. For security reasons, Postman won't automatically include the Authorization header in this subsequent request, especially if the new URL is on a different domain. The new, unauthenticated request then fails, resulting in an error code like 400 Bad Request or 403 Forbidden.

To fix this, you need to manually add the Authorization header to the request. Instead of relying on the built-in "Authorization" tab, you should go to the Headers tab and explicitly create a new header with the key Authorization and its corresponding value. This ensures the header is included in every part of the request, even after a redirect.

Thanks for your time.

I tried adding the autorization to the header but got no luck.

And also tried to directly encode Base64

I also tried in Python but it seems like I am missing a certificate verification.

Excellent thank you for your patience. Yeah turns out that Postman can't handle the URL redirect. Tableau is similar so if you're interested the URL can be found under the Tableau tab in the Data Connector page in MyG.