oauth.net
Bearer Tokens
A Bearer Token is an opaque string that any party in possession of it can use to access protected resources — no proof of identity is required beyond presenting the token itself.
When to use this
Bearer Tokens are the default access token type in OAuth 2.0. Your resource server should accept them in the
Authorization: Bearer HTTP header. If you need stronger security guarantees — preventing stolen tokens from being used by an attacker — consider DPoP or Mutual TLS, which bind the token to a specific client.
A Bearer Token may be an opaque string (validated via token introspection) or a structured token like a JWT access token (validated locally). The format is an implementation choice — the token spec itself does not mandate a structure.
Related specs
- Token Introspection RFC 7662
- Token Revocation RFC 7009
- JWT Profile for Access Tokens RFC 9068
- DPoP — sender-constrained alternative RFC 9449
- Mutual TLS — sender-constrained alternative RFC 8705
More resources
- OAuth 2.0 Access Tokens
- Access Tokens (oauth.com)