What is bearer token?
Quick definition
A security credential that proves authentication and authorization in API requests. Sent in HTTP headers, bearer tokens grant access to protected resources without exposing passwords.
A bearer token is an opaque string credential used in OAuth 2.0 and similar authentication schemes to authorize API requests. When included in the Authorization header as "Bearer <token>", it proves the client has been authenticated and is authorized to access specific resources. The token is generated by an authentication server after a user successfully logs in or grants permission, making it safer than transmitting passwords directly.
Bearer tokens are stateless by design, allowing servers to verify them without maintaining session state. This makes them ideal for distributed systems, microservices, and AI agent communication. The token typically has an expiration time and can be revoked by the issuing server. Most modern APIs, including those used by AI coding agents and MCP servers, use bearer tokens to secure endpoint access and prevent unauthorized resource manipulation.
Developers must treat bearer tokens as sensitive credentials. Never expose them in client-side code, version control, or logs. Store tokens in secure, encrypted storage and transmit them only over HTTPS connections. When building AI agents or automation workflows, use environment variables or secure key management systems to handle bearer tokens safely.
Example
How it shows up in practice
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkFJIEFnZW50In0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8UFrequently asked questions
How is a bearer token different from an API key?
Bearer tokens are typically time-limited and issued after authentication, while API keys are static credentials. Bearer tokens follow OAuth 2.0 standards and are more flexible for permission scoping and revocation.
Can bearer tokens be used for MCP server authentication?
Yes, MCP servers can use bearer tokens in HTTP headers to authenticate client requests, making them suitable for securing communication between AI agents and remote MCP servers.
What should I do if a bearer token is compromised?
Immediately revoke the token through your authentication provider, generate a new one, and audit access logs. Use short expiration times to minimize damage from compromised tokens.
Do bearer tokens work with webhooks?
Yes, bearer tokens can be included in webhook Authorization headers to authenticate incoming webhook requests from external services.