# Authorization Header — Syntax, Values & Examples

> Carries the client's credentials — a bearer token, Basic username and password, or another scheme.

Authorization holds a scheme name followed by credentials. APIs mostly use `Bearer` with an access token such as a JWT; `Basic` sends a Base64-encoded `username:password`. A missing or bad value usually earns a 401 with a `WWW-Authenticate` header naming the expected scheme.

- Type: Request header
- Category: Authentication & cookies
- Defined in: [RFC 9110 §11.6.2 — Authorization](https://www.rfc-editor.org/rfc/rfc9110.html#section-11.6.2)

## Syntax

```http
Authorization: <scheme> <credentials>
```

## Values

| Value | Meaning |
|---|---|
| `Bearer <token>` | an OAuth 2.0 access token, API key or JWT |
| `Basic <base64(user:password)>` | username and password, Base64-encoded — not encrypted |
| `Digest …` | challenge-response hashing; rare today |

## Examples

```http
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9…
```

a JWT access token

```http
Authorization: Basic YWxhZGRpbjpvcGVuc2VzYW1l
```

aladdin:opensesame, Base64-encoded

## Good to know

- Base64 is encoding, not encryption — only send Basic credentials over HTTPS.
- Cross-origin requests with Authorization are preflighted; the server must list it in `Access-Control-Allow-Headers`.
- Don't log this header. Redact it in request logs and error trackers.
- Browsers drop Authorization when a redirect goes to another origin.

## How to set Authorization

### fetch

```
await fetch("https://api.example.com/me", {
  headers: { Authorization: `Bearer ${token}` },
});
```

### curl

```
# Bearer token
curl -H "Authorization: Bearer $TOKEN" https://api.example.com/me

# Basic auth: curl encodes user:password for you
curl -u alice:s3cret https://api.example.com/me
```

### Express (reading it)

```
const [scheme, token] = (req.get("Authorization") ?? "").split(" ");
if (scheme !== "Bearer" || !token) {
  return res.status(401).set("WWW-Authenticate", "Bearer").end();
}
```

## Check it

In the browser, open DevTools → Network, pick a request and look under Request Headers. From the command line, curl's verbose mode prints every header it sends, prefixed with `>`:

```sh
curl -sv https://example.com/ -o /dev/null 2>&1 | grep '^>'
```

## FAQ

### Should I use Bearer or Basic?

Basic suits simple server-to-server calls over HTTPS. Bearer tokens can expire, be scoped and be revoked without changing a password, which is why APIs prefer them.

### Is it safe to put a token in the URL instead?

No. URLs end up in server logs, browser history and Referer headers. Keep tokens in the Authorization header.

## Status codes it appears with

- [401 Unauthorized](https://www.devkult.com/http/401.md)
- [403 Forbidden](https://www.devkult.com/http/403.md)

## Related headers

- [WWW-Authenticate](https://www.devkult.com/headers/www-authenticate.md): Sent with a 401 to tell the client which authentication scheme to use, and sometimes why the last attempt failed.
- [Access-Control-Allow-Headers](https://www.devkult.com/headers/access-control-allow-headers.md): Lists the request headers a cross-origin request may include, in the response to a CORS preflight.
- [Cookie](https://www.devkult.com/headers/cookie.md): Sends the cookies the browser has stored for this site back to the server.

## Further reading

- [JWT decoder](https://www.devkult.com/tools/security/jwt-decoder.md)
- [Base64 encoder](https://www.devkult.com/tools/encoding/base64-encode.md)

Open the interactive page: https://www.devkult.com/headers/authorization