Bearer authentication
Bearer authentication is an authentication scheme in which presenting a bearer token is sufficient to use the access or authorization granted by that token.
ASP.NET Core in Action, 3e
A bearer token is a credential string that conveys authentication information to a service, typically relying on a signature to detect tampering rather than requiring possession-based proof.
- How it is used
- Authenticates API requests by letting clients present tokens containing user or app details.
- How deep it goes
- Defines token possession and follows JWT validation through middleware, then gives practical setup and testing steps.
- Examples
- Tests a minimal API with a dotnet user-jwts token sent through Swagger UI.
- What you can do after
- Apply it via AddJwtBearer and dotnet user-jwts to authenticate and test ASP.NET Core minimal API requests.
Read how ASP.NET Core in Action, 3e explains bearer authentication →
Building Web APIs with ASP.NET Core
Token-based authentication verifies a caller by requiring a token that represents the caller's authenticated identity or claims.
- How it is used
- Enables authenticated requests to protected board-game API endpoints without repeating login for every request.
- How deep it goes
- Walks through Swagger bearer configuration and response-based verification, then shows token forwarding to a role-protected gRPC method.
- Examples
- Tests a protected endpoint for 401 and 200 responses and forwards a token for a Moderator-only board-game update.
- What you can do after
- Apply it via SwaggerUI to send a login-issued JWT, verify protected access, and recognize when a role check is also required.
Read how Building Web APIs with ASP.NET Core explains bearer authentication →
Spring in Action, Sixth Edition
An access token presented in an HTTP Authorization header using the Bearer authentication scheme.
- How it is used
- Carries OAuth 2 access tokens from a Spring client to protected REST API endpoints.
- How deep it goes
- Traces header construction, request interception, request scope, and SecurityContext-based token lookup.
- Examples
- Demonstrates a RestIngredientService calling Taco Cloud API endpoints with writeIngredients authorization.
- What you can do after
- Apply it via Spring Security and RestTemplate to send authorized API requests.
Read how Spring in Action, Sixth Edition explains bearer authentication →
.NET in Action, Second Edition
Bearer authentication is an HTTP authentication method in which possession of a bearer token grants access to a protected resource.
- How it is used
- Uses bearer tokens to authenticate API callers before authorization policies restrict catalog operations.
- How deep it goes
- Inspects the Authorization header and JWT structure, then configures policy-based access using authenticated users and claims.
- Examples
- Uses Swagger UI to inspect a JWT and distinguishes authenticated-user reads from mutations reserved for one identity.
- What you can do after
- Apply bearer authentication through Swagger UI and configure ASP.NET authorization policies for authenticated users and a claim-matched identity.
Read how .NET in Action, Second Edition explains bearer authentication →
Secure APIs
A bearer token is an access credential whose possession is sufficient to present it for authorization without proving possession of a separate key.
- How it is used
- Documents authenticated API endpoints by defining and applying bearer-token security in OpenAPI.
- How deep it goes
- Defines the scheme fields and global or per-operation application, but does not explain token issuance or validation internals.
- Examples
- Uses an OpenAPI JWTBearer YAML definition and protected or public endpoint configuration.
- What you can do after
- Configure bearer-token authentication and its scope in an OpenAPI specification.
Related concepts
- authenticationkind of · Authentication is the process of establishing or verifying the identity of a user, service, device, or other communicating entity.
- cookiealternative to · An HTTP cookie is a small piece of data that a server asks a user agent to store and return with subsequent requests within its scope.
- HTTP Authorization headeruses · The HTTP Authorization header is a request header that carries credentials or other authentication or authorization information for accessing a resource.
- API keyuses · An API key is a credential used to identify or authorize a client accessing an application programming interface.
- basic authenticationcontrasts with · HTTP Basic authentication is an HTTP scheme that transmits a username and password in a Base64-encoded Authorization header, requiring external protection such as TLS for confidentiality.
- openid connectcontrasts with · OpenID Connect is an identity layer built on OAuth 2.0 that enables clients to authenticate end users and obtain standardized identity claims.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.