Bearer token
also: access token, API token, bearer credentials
A security credential used in HTTP requests to authenticate API calls or web services, typically transmitted in the Authorization header without requiring a username and password.
A bearer token is an opaque string that serves as proof of authorization. When included in an HTTP request's Authorization: Bearer <token> header, the server accepts it as valid credentials without needing additional authentication details. The term "bearer" means whoever possesses the token is authorized to use it.
Common examples include OAuth 2.0 access tokens, API keys, and JWT (JSON Web Tokens). For instance, a GitHub API request might use:
curl -H "Authorization: Bearer ghp_1a2b3c4d5e6f" https://api.github.com/userBearer tokens are widely used in REST APIs, microservices, and cloud platforms because they're stateless and don't require server-side session storage. However, they must be transmitted over HTTPS to prevent interception, and should be treated as secrets—never hardcoded or exposed in version control.