bearertokens

Bearer tokens are a type of security token used to access protected resources in modern authorization frameworks. A bearer token serves as proof of authorization; possession of the token is enough to obtain access, without the need to prove the holder’s identity beyond the token itself. Clients present the token to the resource server using the HTTP Authorization header with the scheme Bearer, for example: Authorization: Bearer <token>. In some flows, tokens may also be sent in other places, but sending tokens in URLs is discouraged due to leakage in logs and referer headers.

Bearer tokens are typically issued by an authorization server as part of OAuth 2.0 or OpenID Connect. They may be opaque strings or structured tokens such as JSON Web Tokens (JWT). Regardless of form, servers validate the token’s integrity and claims to determine the token’s validity and the scope of access. When opaque, the resource server relies on an introspection endpoint to learn token details. When JWTs are used, the resource server can verify the signature and directly read claims such as iss (issuer), sub (subject), aud (audience), exp (expiry), and iat/nbf, to enforce policy.

Bearer tokens are usually short-lived and may be accompanied by refresh tokens to obtain new access tokens without re-authenticating. They should be protected in transit via HTTPS, and stored securely on clients. Security practices include minimizing token exposure, rotating tokens, implementing revocation, binding tokens to a client or a device when possible, and validating audience and issuer.

See also: OAuth 2.0, JWT, OpenID Connect, token introspection.