{
    "content": "<h1>Understanding the <a href=\"..\/Bearer-Token\/\">Bearer-Token<\/a><\/h1><p>A <a href=\"..\/Bearer-Token\/\">Bearer-Token<\/a> is a security credential used in <a href=\"..\/API\/\">API<\/a> authentication that grants access to the bearer of the token. It is the most common type of <a href=\"..\/Access-Token\/\">Access-Token<\/a> used in <a href=\"..\/OAuth-2.0\/\">OAuth-2.0<\/a>. The security model of a <a href=\"..\/Bearer-Token\/\">Bearer-Token<\/a> relies on the fact that any party in possession of the token can use it to access protected resources, similar to a physical key or cash.<\/p><h2>Implementation and Usage<\/h2><p>In a typical <a href=\"..\/REST-API\/\">REST-API<\/a> environment, the token is transmitted in the <a href=\"..\/HTTP-Header\/\">HTTP-Header<\/a> using the <code>Authorization<\/code> key. The format is specified in <a href=\"https:\/\/datatracker.ietf.org\/doc\/html\/rfc6750\">RFC 6750<\/a> as <code>Authorization: Bearer [token]<\/code>. This mechanism eliminates the need for the <a href=\"..\/Client-Application\/\">Client-Application<\/a> to manage the user's primary credentials, such as a password, after the initial <a href=\"..\/Authentication\/\">Authentication<\/a> phase.<\/p><h2>Security Considerations<\/h2><p>Because the token itself provides full access, it must be protected from interception. It is mandatory to use <a href=\"..\/Transport-Layer-Security\/\">Transport-Layer-Security<\/a> (TLS) to encrypt the communication channel. Many modern implementations use <a href=\"..\/JSON-Web-Token\/\">JSON-Web-Token<\/a> (JWT) as the format for these tokens, allowing the <a href=\"..\/Resource-Server\/\">Resource-Server<\/a> to verify the token's validity and scope without necessarily querying a central database. For further reading on best practices, see the <a href=\"https:\/\/auth0.com\/docs\/secure\/tokens\/access-tokens\/bearer-tokens\">Auth0 Documentation on Bearer Tokens<\/a>.<\/p><ul><li><a href=\"..\/OAuth-2.0\/\">OAuth-2.0<\/a><\/li><li><a href=\"..\/JSON-Web-Token\/\">JSON-Web-Token<\/a><\/li><li><a href=\"..\/API-Security\/\">API-Security<\/a><\/li><li><a href=\"..\/Access-Token\/\">Access-Token<\/a><\/li><\/ul>",
    "tags": [
        "api",
        "bearer-token",
        "oauth2",
        "security",
        "authentication",
        "authorization",
        "jwt",
        "rest",
        "web-security",
        "identity"
    ]
}