RFC 6750 / START HERE
Bearer tokens, before the details
OAuth 2.0 bearer tokens
A bearer token is a credential usable by whoever possesses it, subject to its validity and permissions. This RFC explains how clients present OAuth bearer tokens to services.
The idea in one picture
An app holds an access token
It presents the bearer credential
The service checks access
A simplified picture of the idea; the chapters explain the actual mechanisms.
Why it exists
Applications need a common way to use access tokens. Because possession matters, token transport and handling must prevent disclosure.
A familiar example
An app sends an access token in an HTTP Authorization header when requesting a protected API resource.
Helpful background
You can start here without reading another RFC. If these ideas are unfamiliar, these short introductions may help.
What you’ll learn next
Begin with chapter one, or choose a topic.
- Possession is the credentialA bearer token can be used by any party possessing it, without proving possession of a cryptographic key.→
- Put it in the request headerThe Authorization header is the standard bearer-token request mechanism.→
- URLs leave extra copiesA query-parameter token can persist in logs and other URL-handling systems.→
- Errors describe different failuresThe server distinguishes malformed requests, invalid tokens, and insufficient privileges.→
- Limit the damage of disclosureAudience and scope restriction reduce where and how a stolen token can be used.→
This introduction explains RFC 6750 (2012). Read the original RFC ↗