What Is a Bearer Token?

What Is a Bearer Token?

A bearer token is a credential where holding it is the proof. Whoever bears the token gets the access. The server does not check who you are beyond confirming the token is valid.

That is the entire model, and it is also the risk. A stolen bearer token works exactly as well for the thief as for you, until it expires or is revoked.

You send it in the Authorization header:

http

The word Bearer, a space, then the token. That format comes from RFC 6750.

01How It Works

Four steps, and the shape is the same across almost every API that uses them.

1. You authenticate once. Username and password, an OAuth flow, or a client credentials exchange.
2. The server issues a token. Usually short-lived, often with a refresh token alongside it.
3. You send the token with every request in the Authorization header.
4. The server validates it and either serves the request or returns 401.

The token replaces re-authenticating on every call. It is not a session, because the server does not have to remember you: a self-contained token carries its own claims and expiry.

02Bearer Token vs API Key

These get used interchangeably and they behave differently.

An API key says which application is calling. A bearer token usually says which user is calling, and for how long.

Some catalogs issue one key covering every service rather than one per API, which reduces the number of credentials you have to store and rotate. ApyHub works this way.

Plenty of APIs accept a long-lived API key in the Authorization: Bearer header, which blurs the line. The header format is not what makes something a bearer token; the model does. If possession alone grants access, it is a bearer credential regardless of what you call it.

03JWTs Are Not the Same Thing

A common confusion worth clearing up.

Bearer describes how a token is used: send it, and holding it is enough.

JWT describes how a token is formatted: a signed, self-contained structure with claims inside.

Most JWTs are used as bearer tokens. Not all bearer tokens are JWTs. An opaque random string works perfectly well as a bearer token, and the server looks it up rather than decoding it.

Opaque tokens are easier to revoke, because the server holds the state. JWTs scale better, because validation needs no lookup. That is the trade.

04The Five Rules

1. Always use HTTPS. A bearer token in plain HTTP is a credential broadcast to the network. This is the one non-negotiable.
2. Never put it in a URL. Query strings end up in server logs, browser history, referrer headers and analytics. Headers do not.
3. Never commit it. Not to a public repo, not a private one. Environment variables and secret managers exist for this.
4. Keep the lifetime short. A token valid for an hour limits the damage from a leak. Pair it with a refresh token for continuity.
5. Never store it in localStorage for a browser app. Any cross-site scripting flaw reads it instantly. An httpOnly cookie is not readable by JavaScript and is the safer default.

That last one is the most commonly ignored, and it is the difference between an XSS bug being annoying and an XSS bug being an account takeover.

05When a Token Fails

401 Unauthorized means the token is missing, malformed, or expired. Get a new one.

403 Forbidden means the token is valid and does not grant access to this resource. A new token will not help; the permissions are wrong.

Confusing these wastes a lot of debugging time. A 401 is about the credential. A 403 is about what the credential is allowed to do.

06FAQ

What is a bearer token?

A credential where possession is proof of authorisation. You send it in the Authorization header prefixed with Bearer, and the server grants access to whoever presents a valid one without further identity checks.

What is the difference between a bearer token and an API key?

An API key is typically long-lived and identifies an application. A bearer token is typically short-lived and identifies a user or session. Both are sent with requests, but the lifetime and what they represent differ.

Is a JWT a bearer token?

Usually it is used as one, but the terms describe different things. Bearer is how a token is used; JWT is how it is formatted. An opaque random string can also be a bearer token.

Where should I store a bearer token in a browser app?

In an httpOnly cookie, which JavaScript cannot read. Storing tokens in localStorage means any cross-site scripting vulnerability exposes them immediately.

Why does my request return 401 with a valid token?

Common causes: the token expired, the Bearer prefix is missing, there is whitespace or a newline in the value, or you are sending it to a different environment than the one that issued it.

What is the difference between 401 and 403?

A 401 means the credential is missing or invalid, so getting a new token may help. A 403 means the credential is valid but lacks permission for this resource, so a new token will not help.

Should bearer tokens expire?

Yes, and quickly. Short lifetimes limit the window in which a leaked token is useful. Use a refresh token to obtain new ones without asking the user to log in again.

07Related

• What Is CORS and Why Is It Blocking My Request? - why the Authorization header triggers a preflight
• 405 Method Not Allowed - a different reason a request gets rejected
• API Fundamentals - authentication from scratch

Source: RFC 6750: OAuth 2.0 Bearer Token Usage

08About ApyHub

ApyHub is a curated API catalog for developers, teams and AI agents: file conversion, data validation, OCR and extraction and more across 20 categories. One key covers all of it, every endpoint is MCP-ready so AI agents can discover and call them directly, and every service page has a playground for testing before you build.

EU-based and EU-hosted, which keeps data residency simple for teams with GDPR obligations.

Browse the catalog | Get a free API key - no credit card required.