Bearer tokens
On This Lesson 4 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
explain token-based API authentication.
Planned topics
- Mobile apps and other services often send a token in a header:
Authorization: Bearer <token>. - "Bearer" means whoever holds the token can use it, like cash. Protect it in transit (HTTPS) and at rest.
- No cookie is sent automatically, which also reduces CSRF risk for pure token APIs.
- The server must still check the token on every request.
Draft outline details
Demonstration
curl -H "Authorization: Bearer eyJ..." https://shop.example/api/orders.
Check your understanding
Why is HTTPS essential for bearer tokens?
Show answer
Anyone who copies the token can use it.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.