Put it in the request header
02The Authorization header is the standard bearer-token request mechanism.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 2.1 ↗
RFC 6750 · § 2.1EXAMPLE
3 / 3
03
Resource-server check
Validate the token and required permissions over protected transport.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
Read the updated RFC section ↗
Clients should use the Authorization: Bearer method.
- Clients should use the Authorization: Bearer method.
- Resource servers must support it.
- Do not use more than one token-transmission method in a request.
The illustration is schematic. Example values are illustrative; profiles and later security guidance can add requirements.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
Privacy