Home / Knowledge hub / Bearer token
Knowledge hub
Bearer token
A token that works for whoever holds it, with no further proof of identity.
What it means
A bearer token is a credential where possession is enough. The API does not ask who is presenting it, only whether it is valid. RFC 6750 puts it plainly: any party in possession of a bearer token can use it, in the same way as any other holder.
Think of a cinema ticket rather than a passport. Nobody checks your name at the door. That makes it simple to use across systems and equally simple to misuse if someone else picks it up.
Why it matters
Because nothing else is checked, a copied token is a full copy of the access. Attackers do not need the password, the second factor or the device. They need one request header, from a log, a browser extension or an error report, and your MFA never gets asked.
That puts the weight on three things: keeping the token short-lived, keeping it out of places it can leak, and sending it only over HTTPS. RFC 6750 requires transport security for exactly this reason.
How it shows up
You meet bearer tokens as Authorization: Bearer ... headers on API calls, usually carrying an access token. They also appear in webhooks, CI systems and cloud service credentials.
The mistakes repeat. Tokens placed in URLs, where they land in server logs, browser history and referrer headers. Tokens printed by debug logging. Tokens that never expire. Tokens accepted over plain HTTP. Check logs, URLs and error pages for token strings, and confirm each one has an expiry.
Questions people ask
Bearer token, answered
Why are they called bearer tokens?
Because whoever bears, or carries, the token is treated as entitled to use it. The name comes straight from the OAuth specification.
It is the opposite of a token bound to a particular device or key.
Are bearer tokens insecure?
Not by themselves. They are a common and reasonable design when handled well: short lives, HTTPS only, minimal scope, kept out of logs.
The risk is that theft equals access.
Can a bearer token be made harder to misuse?
Yes. Sender-constrained tokens, such as those using mutual TLS or DPoP, tie the token to a key so a copy is useless without it.
These add complexity, so they are mostly used for high-value APIs.
Should a token go in a URL?
No. URLs are stored in logs, browser history and sent in referrer headers. RFC 6750 discourages query-string tokens for this reason.
Use the Authorization header.
How do we check for leaked tokens?
Search application and proxy logs for token patterns, and review error pages and third-party scripts that see headers.
A pentest can look for tokens in responses, URLs and redirects of the running app.
Sources
Where this comes from
Related
Terms that sit next to this one
Access token
A short-lived token that lets a client call an API on a user's behalf.
Token replay
Reusing a stolen or captured token to be accepted as its rightful owner.
JWT
A signed token a client carries to prove who is signed in.
Session hijacking
Stealing the token that tells your application a browser is logged in.
Logging and monitoring
Recording what happens, and actually watching what gets recorded.
Who else could present this token?
Tokens that show up in URLs, logs or responses, and any that keep working after they should not, are things we test for. Each finding shows the request and the response. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.