A Bearer-Token<\/a> is a security credential that grants access to a protected resource to anyone who presents the token. In modern Web-Development<\/a>, these tokens are the standard mechanism for implementing Authentication<\/a> and Authorization<\/a> within the OAuth-2.0<\/a> framework. The name implies that the 'bearer' of the token is authorized to access resources, much like a physical key or a ticket.<\/p> As defined in the official specification RFC 6750<\/a>, the token is typically transmitted in the HTTP-Header<\/a> of a REST-API<\/a> request. The standard format uses the Many implementations use the JSON-Web-Token<\/a> (JWT) format for these tokens. This allows the Resource-Server<\/a> to verify the token's integrity and extract claims—such as user identity and permissions—without needing to perform a database lookup for every request. This stateless approach is particularly beneficial for Microservices<\/a> architectures where scalability is a priority. Proper management of API-Security<\/a> also involves implementing token expiration and using Refresh-Tokens<\/a> to mitigate the risks associated with stolen bearer credentials.<\/p>Authorization<\/code> header with the Bearer<\/code> scheme (e.g., Authorization: Bearer [TOKEN]<\/code>). Because any party in possession of the token can use it, it is mandatory to use Transport-Layer-Security<\/a> (TLS) and HTTPS<\/a> to prevent interception by malicious actors.<\/p>