What is a Bearer Token? Definition, JWT and Security

What is a bearer token?

A bearer token is an access credential that grants whatever it authorizes to anyone who presents it. It is defined for OAuth 2.0 in RFC 6750 and travels in the HTTP Authorization header as Authorization: Bearer <token>. The server checks the token and allows or rejects the request. Possession is the only proof required, so a bearer token has to be protected like a password.

How a bearer token works

GET /api/users/me HTTP/1.1
Host: api.example.com
Authorization: Bearer eyJhbGciOiJSUzI1NiJ9...

The server validates the token by looking it up, verifying its signature or calling an introspection endpoint. If the token is expired, revoked or malformed, RFC 6750 says the server should answer 401 and may include an invalid_token error:

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer error="invalid_token"

The usual flow:

1. The client authenticates, for example through an OAuth 2.0 flow or a login.
2. The authorization server returns an access token, typically as JSON:

   {"access_token": "...", "token_type": "Bearer", "expires_in": 3600}

3. The client keeps the token and sends it in the Authorization header on every API call.
4. The API checks the token and its permissions (scopes) on each request.
5. When the token expires, the client uses a refresh token to get a new one, or authenticates again.

Bearer token formats

Opaque tokens

A random string that carries no information. The server stores what it means and looks it up on every request, so revoking one is as simple as deleting the record. The cost is a lookup per request.

Authorization: Bearer 7b3f2e8a-1c4d-4b6a-9e7f-2c8d3a4b5e1f

JWTs (JSON Web Tokens)

A JWT (RFC 7519) is a signed, self-contained token: header.payload.signature, each part Base64URL-encoded. The payload holds claims such as the user, scopes and expiry, and the API can verify the signature without a database call. The trade-off is revocation: a JWT stays valid until it expires unless you keep a denylist. Remember that decoding a JWT only reads it. Trust comes from verifying the signature. You can inspect one safely with the JWT decoder.

Bearer token vs other credentials

An API key is often sent as a bearer token too. The difference is in lifetime and scope: bearer access tokens are meant to be short-lived and narrowly scoped, API keys usually are not.

OAuth 2.0 flows that issue bearer tokens

• Authorization code with PKCE. For apps with users: the user signs in with the provider and the app exchanges a code for tokens. PKCE protects public clients such as mobile apps and single-page apps.
• Client credentials. For server-to-server calls with no user: the app authenticates with its client ID and secret and receives an access token.
• Refresh token. A longer-lived credential used only to obtain new access tokens, with stricter storage rules.
• Device code. For devices without a browser, such as TVs and command-line tools.

Bearer token security

Because possession equals access, a stolen token works for whoever holds it until it expires.

• Always use TLS. RFC 6750 says clients must always use TLS when sending bearer tokens.
• Keep tokens out of URLs. The spec allows an access_token query parameter only when the header and body are impossible, and calls it not recommended. URLs end up in logs and browser history.
• Keep access tokens short-lived and rotate refresh tokens, so a leak has a small window.
• Request the narrowest scope. A token that reads a profile should not be able to delete the account.
• Validate every JWT fully. Verify the signature with your own configured algorithm and key (never the algorithm named in the token's header), then check issuer, audience and expiry.
• Store tokens carefully. Mobile apps use the system keychain or keystore, servers use a secret manager. Browser scripts can read localStorage, which makes XSS a theft vector. Read more in API security.

Common bearer token mistakes

• Logging the Authorization header in access logs, proxies or error trackers.
• Issuing access tokens that live for days or weeks, which turns them into API keys.
• Accepting a JWT without checking its signature, issuer or audience.
• Using one shared HS256 secret across services, so every service that can verify tokens can also forge them.
• Putting the token in a query string or a front-end bundle.

Testing and monitoring APIs that use bearer tokens

Authentication changes how you test an API under load:

• Fetching a token is itself an endpoint. If every virtual user requests one at the start, you load-test the authorization server as well. Decide whether that is what you want.
• Tokens expire during long runs. A 30-minute test with 15-minute tokens needs refresh logic in the script.
• A single shared token hides per-user limits and caches. Realistic runs use a token per virtual user.
• Check the negative paths: an expired or revoked token should return 401 quickly.

These problems are covered step by step in the guide to performance testing APIs with OAuth 2.0 and in how to test OAuth-secured APIs with JMeter. For continuous checks, LoadFocus API monitoring supports headers, OAuth bearer tokens and chained requests, and checks run every 5 minutes on the free plan. To run the token flow under load, see JMeter load testing.

FAQ: Bearer tokens

Are bearer tokens secure?

They are as secure as the way you handle them. Send them only over TLS, keep them short-lived, scope them narrowly and never log them. Anyone who gets a valid token can use it.

What is the difference between a bearer token and a JWT?

Bearer describes how a token is used: whoever presents it gets access. JWT describes its format: a signed token with claims. A JWT is often used as a bearer token, but a bearer token can also be an opaque random string.

How long should a bearer token last?

As short as your application tolerates, typically minutes to an hour for access tokens, with a refresh token to renew them. The longer a token lives, the more damage a leak does.

Can a JWT bearer token be revoked?

Not on its own, because the API verifies it without asking anyone. Teams use short lifetimes plus refresh token rotation, a denylist, or opaque tokens with introspection when immediate revocation matters.

What should I do if a token is stolen?

Revoke it and its refresh token, rotate any signing key that may be exposed, and review access logs for use from unexpected places.

How do I send a bearer token with curl?

Add the header: curl -H "Authorization: Bearer YOUR_TOKEN" https://api.example.com/me. The free curl online tool lets you try a request from the browser.