If youโve ever worked with APIs, youโve probably come across something like this:
Authorization: Bearer abc123
Enter fullscreen mode Exit fullscreen mode
And maybe you paused for a second and thought:
Why โBearerโ? Is there a bear involved? ๐ป
Not quite but the concept is actually pretty simple.
What Is a Bearer Token?
Think of a bearer token like a concert ticket.
Whoever holds the ticket gets in. No questions asked.
Similarly, whoever holds a valid token can access the API.
Valid ticket โ Enter concert
Valid token โ Access API
Enter fullscreen mode Exit fullscreen mode
Thatโs why itโs called a Bearer token the person โbearingโ (holding) the token gets access.
Why Not Just Send the Token?
You might wonder why we donโt just send the token like this:
Authorization: abc123
Enter fullscreen mode Exit fullscreen mode
The problem is, the server wouldnโt know what that value represents. Is it a password? An API key? Something else?
By adding the word Bearer, we give the server context:
Authorization: Bearer abc123
Enter fullscreen mode Exit fullscreen mode
Now the server understands:
This is a bearer token. I know how to handle and validate it.
Different Types of Authorization
The Authorization header isnโt limited to bearer tokens. It supports multiple authentication schemes:
Authorization: Basic <credentials>
Authorization: Bearer <token>
Authorization: Digest <credentials>
Enter fullscreen mode Exit fullscreen mode
The first word acts like a label, telling the server how to interpret the rest.
Hereโs a quick breakdown:
Basic โ Username and password
Bearer โ Access token
Digest โ Challenge-response authentication
Enter fullscreen mode Exit fullscreen mode
Without this label, the server would have to guess and thatโs not something servers are good at (or enjoy).
Why Is Bearer So Popular?
Because itโs standardized and widely supported.
Most API gateways, backend frameworks, and authentication libraries already understand this format. Itโs easy to parse and implement.
For example:
const [scheme, token] = authorizationHeader.split(" ");
Enter fullscreen mode Exit fullscreen mode
This gives you:
scheme = "Bearer";
token = "abc123";
Enter fullscreen mode Exit fullscreen mode
Simple, clean, and no need for custom headers or complex parsing logic.
Are Bearer Tokens Always JWTs?
Nope.
A JWT (JSON Web Token) is just one type of bearer token:
Authorization: Bearer eyJhbGciOi...
Enter fullscreen mode Exit fullscreen mode
But bearer tokens can also be simple random strings:
Authorization: Bearer x7a91k2p
Enter fullscreen mode Exit fullscreen mode
The key takeaway:
Bearer = how the token is sent
JWT = one possible format of the token
Enter fullscreen mode Exit fullscreen mode
Why HTTPS Matters
Bearer tokens are like cash if someone gets hold of them, they can use them.
Thatโs why you should always send them over HTTPS:
HTTPS โ
HTTP โ
Enter fullscreen mode Exit fullscreen mode
Also, avoid putting tokens in URLs:
/api/profile?token=abc123
Enter fullscreen mode Exit fullscreen mode
URLs can be stored in browser history, logs, and analytics tools, making them less secure.
The Authorization header is the safest and most standard place to include your token.
Final Thoughts
When you see this:
Authorization: Bearer <token>
Enter fullscreen mode Exit fullscreen mode
It simply means:
โHey API, Iโm using Bearer authentication, and hereโs my access token.โ
Itโs popular because itโs clear, standardized, and supported across modern web technologies.
And no still no actual bears involved. ๐ป
๋ต๊ธ ๋จ๊ธฐ๊ธฐ