Bearer token
Also called: Access token
An access token sent as Authorization: Bearer <token>; whoever holds it is treated as the user.
Definition
After login, the server issues an access token that the app sends on every request in the Authorization header. Like a ticket, it isn't tied to a face: anyone who has it can use it until it expires or is revoked. Testers check that missing, invalid and expired tokens get 401 and that tokens are masked in bug reports.
In practice
GET /v1/users/me with "Authorization: Bearer eyJhbGci..." returns Anna's profile; without the header it returns 401.
Learn it in context
Lessons that use this term.
Related terms
- JWTJSON Web Token: a signed token with three base64url parts (header, payload, signature) that APIs use to identify the caller.
- AuthenticationChecking who a user is, usually with a password, a code or biometrics.
- Refresh tokenA longer-lived token used only to get a new access token when the old one expires.