What is Bearer Token?
Bearer Token is an access token type used in HTTP authentication where the client presents a token to access protected resources. The term 'bearer' means that any party holding the token can use it to access the resource, without needing additional proof of identity.
Quick Facts
| Full Name | Bearer Authentication Token |
|---|---|
| Created | 2012 (RFC 6750) |
| Specification | Official Specification |
How It Works
Bearer tokens are commonly used in OAuth 2.0 authentication flows. They are typically sent in the HTTP Authorization header with the format 'Bearer <token>'. The token itself is usually a JWT (JSON Web Token) or an opaque string. Bearer tokens are stateless, meaning the server doesn't need to store session information. However, because anyone with the token can use it, they must be transmitted securely over HTTPS and stored safely. Tokens typically have expiration times and can be revoked by the authorization server.
Key Characteristics
- Sent in Authorization header as 'Bearer <token>'
- Commonly used with OAuth 2.0
- Token holder has access (no additional proof needed)
- Usually JWT or opaque string format
- Stateless authentication mechanism
- Must be transmitted over HTTPS
Common Use Cases
- API authentication
- OAuth 2.0 access tokens
- Single sign-on (SSO) systems
- Mobile app authentication
- Microservices authorization
Example
Loading code...Frequently Asked Questions
Why is it called a 'bearer' token?
It's called 'bearer' because whoever bears (possesses) the token can use it to access protected resources, similar to a physical key. No additional proof of identity is required beyond presenting the token.
How should bearer tokens be stored securely?
Bearer tokens should be stored in secure, httpOnly cookies or secure storage mechanisms. Avoid storing them in localStorage or sessionStorage for sensitive applications, as they can be vulnerable to XSS attacks.
What happens if a bearer token is stolen?
If stolen, an attacker can impersonate the legitimate user until the token expires or is revoked. This is why tokens should always be transmitted over HTTPS and have short expiration times.
What is the difference between bearer tokens and API keys?
Bearer tokens are typically short-lived, user-specific, and issued through authentication flows like OAuth 2.0. API keys are usually long-lived, application-specific, and used for identifying the calling application rather than the user.
How do I refresh an expired bearer token?
Most OAuth 2.0 implementations provide a refresh token alongside the bearer token. When the bearer token expires, you can use the refresh token to obtain a new access token without requiring the user to re-authenticate.