Support using id_token as the Bearer token for requests

[kzbt]

Is your feature request related to a problem? Please describe.
I'm not an oauth2 or openid expert, so I'm not sure if this makes sense.

Right now when using the Authorization Code grant type with openid, we get back 3 tokens: 1) access_token 2) id_token and 3) refresh_token. Due to some limitations with auth providers sometimes we can only use the id_token in our applications. However, Insomnia always uses the access_token in requests.

Describe the solution you'd like
Add a configuration option in the OAuth2 options to use id_token for a particular request

Describe alternatives you've considered
Currently I'm copying and pasting the id_token field to the access_token field

Additional context
NA

[doronguttman]

if you got here by searching for a solution, like me, apparently Insomnia now supports this in an undocumented (at least none that I could find) way:

1. configure OAuth2 as usual
2. make sure to request a scope which provides the relevant token
3. go to the Headers tab
4. Add Authorization header, where value is:
   • for id_token: Bearer {% request 'oauth2-identity', '', 0 %}
   • for refresh_token: Bearer {% request 'oauth2-refresh', '', 0 %}

[garug]

Nice workaround! It's a little tricky ugly since we can disable auth and still get request authorized but still is a valid solution!

I think on implement this suggestion for fun, thinking on how to display this info on Oauth window...

[sm29105]

Unfortunately on my side it's only partially working. I need that setting on a folder level to inherit for all requests under it. For newly created requests it permanently fails - looks like a timing issue: the new request has not yet the tokens "attached" and in we get the error "No OAuth 2.0 access tokens found for request" (found in the Developer Tools view). When executing the request once without setting the header, it fetches the tokens first (request fails of course) - and when re-activating the header overwriting, it works from then on. Any suggestions?

[HoseynAAmiri]

Can we just have a selection drop down where the user selects if they want id_token or access_token to be used? This option exists in Postman and I like insomnia more than Postman.

Thank you

[anttonO]

Hi! 👋
Just wanted to ask if this request is planned to be included in any upcoming release, or if there’s a roadmap/timeline available. It would be very helpful to know for planning purposes.
Thanks!