Skip to main content
All glossary terms

Credentials & security

Bearer token

A bearer token is a credential whose holder can exercise the permissions associated with it, without proving possession of a separate private key. The resource server evaluates the token and its context; the token’s name alone does not reveal its exact scope or lifetime.

Also known as bearer credential.

Why it matters in practice

Bearer tokens should be protected from disclosure because anyone who obtains a usable token may be able to present it. TLS, narrow permissions, expiry, and careful storage reduce exposure but do not eliminate misuse risk. A token may authenticate to an API or proxy depending on the service and request header.

Example

A client presents a short-lived placeholder-backed bearer token to api.example.com and avoids printing the value in diagnostic output.

Educational note

This definition is general information, not legal advice. It may omit facts that matter to a specific situation and does not establish or guarantee compliance.