Bearer token
A bearer token is a credential that a client sends in an Authorization header, after the word Bearer. The server accepts it from whoever presents it, with no proof of who holds it. Anyone who holds the token can use it until it expires or is revoked. RFC 6750 defines the scheme.
How it works
A client sends the token with each request:
Authorization: Bearer <token>The server checks that the token is valid and that it grants the requested access. The client, not the browser, adds the header. That is the main difference from a cookie.
Why it matters for AI agents
Bearer tokens are common in APIs and in OAuth flows. An agent that calls such an API holds the same access as the token. A leaked token gives an attacker the same access. Keep tokens out of logs, screenshots and shared files.
| Bearer token | Session cookie | |
|---|---|---|
| Sent by | Your code, in the Authorization header | The browser, automatically |
| Sent to | The API that issued or accepts it | The site that set it |
| Added for you by the browser | No | Yes |
Wield and bearer tokens
Wield's recorder strips auth headers and tokens on your device before a recording leaves your computer. A recipe can derive a bearer token that the site's page keeps. Wield redacts that value from results, logs and error messages.
Related terms
FAQ
Is a bearer token the same as an API key?
Not quite. A bearer token is a way of sending a credential, in the Authorization header with the Bearer scheme. An API key is a kind of credential. Some APIs accept an API key as a bearer token, and others use a different header.
How long do bearer tokens last?
It varies. RFC 6750 does not set a lifetime. The server that issues the token decides when it expires, and it can revoke a token earlier. Check the API's documentation for its rules.
Sources
- RFC 6750: The OAuth 2.0 Authorization Framework: Bearer Token Usagedatatracker.ietf.org