How do I send a Bearer token in the Authorization header?

Steps

1. Open the role and tick Header (token / API key) under Authentication methods.
2. Click + Add header to add a row.
3. Type Authorization in the name box.
4. In the value box, type Bearer, a space, and then your token. The placeholder reads Bearer ... to show the shape.
5. Press Save.

Good to know

A Bearer token goes in as one header. The word Bearer and the space after it are part of the value. Leave out the space and many APIs refuse the request.

A token stored in a header stays exactly as you typed it. When your tokens expire quickly, use OAuth 2.0 client credentials instead, since Cyberlop then mints a fresh token when the scan runs.

You can also add AI guidance on the same role to explain the token, for example that it belongs to an admin. See how to add AI guidance.

Do not reuse a token from a real person's session. Make a new one for the scan, give it the access the test needs and nothing more, and delete it when the work ends. That keeps the blast radius small if the token ever leaks.

Create the token for this job and keep its reach small. Only test apps you have permission to test.

Related questions

• How do I authenticate the scanner with an API key header?
• How do I set up OAuth 2.0 client credentials for a role?
• How do I remove a header from a role?
• How do I give the scanner AI guidance on how to use a credential?
• My API rejects the OAuth token part-way through a scan. How do I tell the scanner to get a fresh one?

Full tutorial

How to add header token authentication to a scan profile

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre