Skip to main content
All glossary terms

Credentials & security

Authorization header

The HTTP Authorization header carries credentials that a client presents to the server responsible for the requested resource. The scheme determines how the value is interpreted; the header is separate from Proxy-Authorization, which is intended for a proxy hop.

Also known as HTTP Authorization header.

Why it matters in practice

Applications often use Authorization for an upstream API token, but header handling depends on the protocol and service. Proxies that modify requests must preserve the intended recipient and prevent credentials from leaking across hosts. Encrypting transport protects the header in transit only between the endpoints of that TLS connection.

Example

A client sends a bearer credential in Authorization to api.example.com after the proxy connection has been established.

Educational note

This definition is general information, not legal advice. It may omit facts that matter to a specific situation and does not establish or guarantee compliance.