Bearer token
A token that works like cash: whoever holds it gets the access, and the server never asks how they got it.
See it
What it is
A bearer token is a credential you present by simply holding it. You put it in an HTTP header, 'Authorization: Bearer eyJhbGci...', and the server checks that the token is valid and unexpired. It does not check that you are the one it was issued to, because it has no way to. Like cash, or a movie ticket: possession is the whole proof. 'Bearer' describes how the token is used, not what is inside it, so the token itself can be a signed JWT the API verifies locally, or an opaque random string the API looks up in a store.
Reach for bearer tokens for machine-readable APIs: mobile apps, single page apps, service-to-service calls, anything already speaking JSON over HTTPS. Almost every OAuth 2.0 access token you will ever handle is a bearer token (RFC 6750). Browser sessions are the exception worth considering: an HttpOnly cookie is also 'held', but scripts cannot read it, which is a real security upgrade over a token sitting in JavaScript memory.
Gotchas: a leaked bearer token is a leaked account until it expires, so keep lifetimes short (minutes, not months) and always require TLS. Never put one in a URL query string, where it lands in server logs, browser history, and Referer headers on every outbound link. And 'Bearer' is one word with one space before the token: a surprising share of 401s are just a missing prefix or a stray newline.
Ask AI for it
Protect this API with bearer token authentication. Read the 'Authorization: Bearer <token>' header on every request, reject a missing or malformed header with 401 and a WWW-Authenticate: Bearer response header, verify the token (signature, issuer, audience, and expiry for a JWT; a hashed lookup for an opaque token), and attach the resolved user to the request context. Require HTTPS, never accept the token from a query parameter, keep the access token lifetime at 15 minutes, and redact the header value from all logs and error reports.