title: How to call API with AntiForgeryToken using Postman in IdentityServer ASP.NET Core
body: <p>I'm trying to test my API with Identity Server Asp.net Core using Postman.</p>
  
  <p>This is the way that I'm trying to do:</p>
  
  <ol>
  <li>First request <code>HttpGet</code> to <a href="https://localhost:5000/Account/Login" rel="noreferrer">https://localhost:5000/Account/Login</a> and in response body I received: <code>&lt;input name="__RequestVerificationToken" type="hidden" value="CfDJ8MoS9upoM4dNp8Kx-AdvA-uYr13_PAkuMZpzYMV8UmxZq5GdLTvN-Ht5NpTLmPtlhL5d5z2Hu2vUJoJGhk1AMlARDcOwqgq7Cef1dfQL_vl4tIFM4kx9RZPz8DHU26-U9qLnKAIstZgR42-1FuGNh24" /&gt;</code></li>
  </ol>
  
  <p>And in Cookie (not sure for what it is though):
      <a href="https://i.stack.imgur.com/pUnXD.png" rel="noreferrer"><img src="https://i.stack.imgur.com/pUnXD.png" alt="enter image description here"></a></p>
  
  <ol start="2">
  <li>Then <code>HttpPost</code> to <a href="https://localhost:5000/Account/Login" rel="noreferrer">https://localhost:5000/Account/Login</a> with <code>RequestVerificationToken</code> with token received from body <code>HttpGet</code> request.
  <a href="https://i.stack.imgur.com/B4xlI.png" rel="noreferrer"><img src="https://i.stack.imgur.com/B4xlI.png" alt="enter image description here"></a></li>
  </ol>
  
  <p>And always <code>error 400</code> as you can see at screen shot above.</p>
  
  <p>In Visual studio I can see that some request was catched but clearly was incorrect.
  <a href="https://i.stack.imgur.com/RoTSw.png" rel="noreferrer"><img src="https://i.stack.imgur.com/RoTSw.png" alt="enter image description here"></a></p>
  
  <p>If I'll remove attribute <code>[ValidateAntiForgeryToken]</code> then of course everything works fine but obviously because that validation is disabled. </p>