Skip to content
uencoder

Bearer Token

A Bearer token is a token type that works purely by possession: it is sent in the Authorization: Bearer <token> header, so whoever holds it can use it, with no additional credentials.

Purpose

It provides a simple token-based authentication mechanism in which the token itself is the credential.

Mechanism

The header is Authorization: Bearer <token>. The server validates the token's validity and permissions. The token can be a JWT, an opaque token, and so on. Security relies on HTTPS to prevent transit leakage and on token lifetime; once leaked, the token can be used for impersonation.

Use cases

  • API Bearer authentication
  • OAuth 2.0 access token
  • Carrying JWTs
  • Service-to-service authentication

Examples

  • Input 
    Authorization: Bearer eyJ...
    Output 
    The server verifies the JWT signature and expiry

    Possession grants validity

Common errors

A leaked token is immediately used for impersonation
Use short lifetimes, HTTPS, and a revocation list

Related terms

JWT
JWT (JSON Web Token) is a compact, self-contained token that securely conveys claims as a JSON object, widely used for stateless authentication and information exchange.
GLOSSARY
OAuth
OAuth 2.0 is an authorization framework that lets third-party applications access a user's resources with the user's consent, without sharing passwords, by using tokens.
GLOSSARY
Basic Auth
HTTP Basic authentication sends the username and password Base64-encoded in the Authorization header; it is simple but must be used over HTTPS.
GLOSSARY

Related tools

Bearer Token Generator
Build a 'Bearer <token>' Authorization header (RFC 6750) from a token string. The token is validated against the b64token syntax — characters outside letters, digits, -._~+/ and a trailing '=' are rejected (guards against header injection).
TOOL
JWT Encoder
Encode JWT with HS256. Free, private, 100% client-side. Not for server-side verification.
TOOL

References