Authorization
request headerauthentication & cookies
Carries the client's credentials — a bearer token, Basic username and password, or another scheme.
Authorization holds a scheme name followed by credentials. APIs mostly use Bearer with an access token such as a JWT; Basic sends a Base64-encoded username:password. A missing or bad value usually earns a 401 with a WWW-Authenticate header naming the expected scheme.
Syntax
Authorization: <scheme> <credentials>
Defined in RFC 9110 §11.6.2 — Authorization.
Values
| Bearer <token> | an OAuth 2.0 access token, API key or JWT |
|---|---|
| Basic <base64(user:password)> | username and password, Base64-encoded — not encrypted |
| Digest … | challenge-response hashing; rare today |
Examples
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9…
a JWT access token
Authorization: Basic YWxhZGRpbjpvcGVuc2VzYW1l
aladdin:opensesame, Base64-encoded
Good to know
- Base64 is encoding, not encryption — only send Basic credentials over HTTPS.
- Cross-origin requests with Authorization are preflighted; the server must list it in
Access-Control-Allow-Headers. - Don't log this header. Redact it in request logs and error trackers.
- Browsers drop Authorization when a redirect goes to another origin.
Further reading: JWT decoder · Base64 encoder
How to set Authorization
await fetch("https://api.example.com/me", {
headers: { Authorization: `Bearer ${token}` },
});# Bearer token curl -H "Authorization: Bearer $TOKEN" https://api.example.com/me # Basic auth: curl encodes user:password for you curl -u alice:s3cret https://api.example.com/me
const [scheme, token] = (req.get("Authorization") ?? "").split(" ");
if (scheme !== "Bearer" || !token) {
return res.status(401).set("WWW-Authenticate", "Bearer").end();
}Check it
In the browser, open DevTools → Network, pick a request and look under Request Headers. From the command line, curl's verbose mode prints every header it sends, prefixed with >:
curl -sv https://example.com/ -o /dev/null 2>&1 | grep '^>'
Frequently asked questions
Should I use Bearer or Basic?
Basic suits simple server-to-server calls over HTTPS. Bearer tokens can expire, be scoped and be revoked without changing a password, which is why APIs prefer them.
Is it safe to put a token in the URL instead?
No. URLs end up in server logs, browser history and Referer headers. Keep tokens in the Authorization header.