title: Postman Resolving "Invalid CORS request" for a POST Request
body: <p>I've just started using Postman to test an API I am integrating to.</p>
  
  <p>I have the following error that keeps showing up </p>
  
  <blockquote>
    <p>Invalid CORS request</p>
  </blockquote>
  
  <p>Note the following:</p>
  
  <ol>
  <li>The API uses Bearer token authentication(OAuth2). I have this
  working without a problem.</li>
  <li>I do get the bearer token successfully, assign it to an Environment variable and then attempt to use it for the RESTful operations.</li>
  <li>The problem is in the subsequent RESTful operation that uses the token.</li>
  <li>When I use an old token (through a POST operation), it rightfully
  tells me that it is expired and not authorized.   </li>
  <li>When I then generate a new one and try to run the restful call, it gives me that <code>Invalid CORS request</code> error.</li>
  <li><strong>Using cURL, I have no issues. But I am frustrated by Postman</strong>.</li>
  </ol>
  
  <p>What I have found so far:</p>
  
  <ol>
  <li><a href="https://devexchange.thirdlight.com/viewtopic.php?id=94" rel="noreferrer"> Using postman with Http POST requests</a> <strong><em>- I don't get the part in bold</em></strong></li>
  </ol>
  
  <blockquote>
    <p>Just in case anybody else has this same problem, here is how to solve
    it. Go to <a href="https://www.getpostman.com/docs/capture" rel="noreferrer">https://www.getpostman.com/docs/capture</a> in your chrome
    browser.  Click on interceptor extension and then choose add to
    chrome.  Once it is added there is a new icon top right of both the
    browser and postman that looks like a traffic light.  In postman click
    this and it turns green. <strong>Then add a header to every request going to</strong>
    <strong>third light.  Every header consists of the header name and a value.</strong> 
    <strong>Start typing over the header name and a list of allowed http headers</strong>
    <strong>comes up.  Choose "Origin".  In the cell for value simply type the</strong>
    <strong>full URL of your server.  (Do not forget the 'http://' or 'https://')</strong>.</p>
  </blockquote>
  
  <ol start="2">
  <li><a href="https://stackoverflow.com/a/14064273">What is the expected response to an invalid CORS request?</a> - <strong>Best explanation I have seen so far on CORS errors.</strong></li>
  </ol>
  
  <p>The other material speaks about <code>Access-Control-Allow-Method header</code>, <code>preflight requests</code></p>
  
  <p>... and there is an illustrative Apache Tomcat flowchart of the CORS flow.</p>
  
  <p><a href="https://i.stack.imgur.com/TIETI.jpg" rel="noreferrer"><img src="https://i.stack.imgur.com/TIETI.jpg" alt="enter image description here"></a></p>