What is Bearer Token?
Also called Access Token.
A bearer token is a credential whose mere possession grants access, presented in an HTTP Authorization header with the Bearer scheme. The server validates the token and needs no further proof of identity, which is what the term bearer means. Bearer tokens are defined for OAuth 2.0 in RFC 6750 and are usually short lived.
The header format is a single line: Authorization followed by the word Bearer and the token string. Servers validate it either by looking the token up in a store or, for self contained formats such as signed JSON Web Tokens, by verifying the signature and reading the claims inside. The second approach avoids a lookup per request but makes immediate revocation harder.
Because anyone holding the token can use it, transport security is not optional. Bearer tokens must travel only over TLS, must never be placed in a URL where they land in logs and browser history, and should not be written to disk or console output. A leaked token is equivalent to a leaked password until it expires or is revoked.
Short lifetimes are the main mitigation. Access tokens commonly expire in minutes to hours, with a separate longer lived credential used to obtain new ones, so a stolen token has a bounded window of usefulness. Tokens are also normally scoped, limiting what the holder can do even within that window.
Bearer tokens differ from static API keys chiefly in lifecycle rather than mechanics. A key tends to be long lived and tied to an account, while a token is issued by an authorization step, carries scopes and an expiry, and can be revoked without disturbing the underlying credentials. Stronger schemes bind a token to a specific client key so possession alone is insufficient.
Key points
- Possession alone grants access; no extra proof needed
- Sent as Authorization: Bearer over TLS only
- Never place in URLs, logs, or source control
- Short expiry limits the damage from a leak
- Scopes bound what the holder may do
In practice
A service exchanges an authorization code for an access token valid for one hour, scoped to reading calendar events. Every subsequent request carries that token in an Authorization header. When it expires the service obtains a new one silently. Because the token is scoped to reading, an attacker who captured it could list events but could not delete a calendar or change account settings.