Tokens and credentials
Bearer token
A token that grants access to whoever presents it, with no proof that the presenter is its intended holder.
What Bearer token means
A bearer token is a credential that works for any party holding it, like cash. RFC 6750 defines how OAuth access tokens are sent this way, in the Authorization: Bearer header, and states plainly that a party in possession can use it without demonstrating possession of a key.
Defined in: RFC 6750 — The OAuth 2.0 Authorization Framework: Bearer Token Usage.
How it works
Bearer tokens are simple: the resource server checks the token and nothing else. That simplicity is why they dominate, and why their security depends entirely on never being exposed — TLS on every hop, no tokens in URLs, no tokens in logs.
The alternative is a sender-constrained token, bound to a key the client holds through DPoP (RFC 9449) or mutual TLS (RFC 8705). A copied sender-constrained token is useless without the private key.
The mistake people actually make
Logging full request headers in an API gateway or error tracker. Every bearer token that passes through becomes readable by anyone with log access, for as long as the logs are retained.
Guides that go deeper
Related terms
Access token
A credential presented to an API to prove the caller is authorized, typically short-lived.
DPoP
Demonstrating Proof of Possession — binds a token to a key the client holds, so a stolen token alone is useless.
Sender-constrained token
An access or refresh token bound to a key the client holds, so it cannot be used by anyone who merely copies it.
Building on any of this?
Tell us what you're putting together. We'll tell you plainly whether Authreads fits it.