Bearer authentication

As explained in Secure APIs

A bearer token is an access credential whose possession is sufficient to present it for authorization without proving possession of a separate key.

Bearer authentication uses a token that can be presented for authorization without proving possession of a separate key. In an API request, place the token after the Bearer keyword in the Authorization header: Authorization: Bearer <token>. section 8.1

OpenAPI describes this mechanism as an HTTP security scheme. A JWT bearer definition identifies the scheme as Bearer and records JWT as its format; the scheme can protect the whole API or selected operations. section 8.1

JWT bearer scheme

components: securitySchemes: JWTBearer: description: Bearer JSON Web Token type: http scheme: Bearer bearerFormat: JWT section 8.1

Figure 8.1 We define the security schemes that protect our API in the specification’s components section under securitySchemes, and we apply them globally to the API under the specification’s security field or per operation using the operation’s security field.

Use the figure to compare global authentication settings with per-operation overrides, such as leaving one endpoint public while protecting another. section 8.1

How Secure APIs covers it

How deep it goes

Defines the scheme fields and global or per-operation application, but does not explain token issuance or validation internals.

Examples

Uses an OpenAPI JWTBearer YAML definition and protected or public endpoint configuration.

What you can do after

Configure bearer-token authentication and its scope in an OpenAPI specification.

How it connects

Connects HTTP authentication, Authorization headers, JWTs, OpenAPI, and operation-level security.

liveBookmanning.com

Read Secure APIs on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  ASP.NET Core in Action, 3eA bearer token is a credential string that conveys authentication information to a service, typically relying on a signature to detect tampering rather than requiring possession-based proof.
• 

  liveBookmanning.com
  Building Web APIs with ASP.NET CoreToken-based authentication verifies a caller by requiring a token that represents the caller's authenticated identity or claims.
• 

  liveBookmanning.com
  Spring in Action, Sixth EditionAn access token presented in an HTTP Authorization header using the Bearer authentication scheme.
• 

  liveBookmanning.com
  .NET in Action, Second EditionBearer authentication is an HTTP authentication method in which possession of a bearer token grants access to a protected resource.

Compare how 5 books explain bearer authentication →

Related concepts

• authenticationkind of · Authentication is the process of establishing or verifying the identity of a user, service, device, or other communicating entity.
• cookiealternative to · An HTTP cookie is a small piece of data that a server asks a user agent to store and return with subsequent requests within its scope.
• HTTP Authorization headeruses · The HTTP Authorization header is a request header that carries credentials or other authentication or authorization information for accessing a resource.
• API keyuses · An API key is a credential used to identify or authorize a client accessing an application programming interface.
• basic authenticationcontrasts with · HTTP Basic authentication is an HTTP scheme that transmits a username and password in a Base64-encoded Authorization header, requiring external protection such as TLS for confidentiality.
• openid connectcontrasts with · OpenID Connect is an identity layer built on OAuth 2.0 that enables clients to authenticate end users and obtain standardized identity claims.

This explainer was generated by Manning's knowledge graph from the text of Secure APIs. The section links point to the parts of the book it draws on.