{"id":"concept:bearer-token","kind":"concept","label":"Bearer Token","synonyms":["authorization header"],"definition":"A bearer token is the mechanism by which an API key is actually presented on each request, typically in an Authorization header, proving the caller holds a valid credential without a separate login flow.","summary":"The transport, not the credential itself. The API key is the secret; the bearer token is how that secret rides along on every single tool call, in an Authorization header, so the server can verify it on each request rather than requiring a fresh login every time.","explanation":["A bearer token is the specific way a credential gets presented on an HTTP request — carried in an Authorization header, typically as \"Bearer <the key>\" — so a server can verify the caller holds a valid credential without running a separate login exchange on every single call.","It's worth distinguishing this from the API key itself: the key is the actual secret, issued once and tied to a specific user's books. The bearer token is the mechanism that secret rides along on, request after request, proving possession of the key without re-authenticating from scratch each time.","\"Bearer\" describes the trust model plainly: whoever bears the token — presents it on a request — is trusted as the party it represents, the same way a bearer bond belongs to whoever's holding it. There's no additional check beyond possessing a valid token, which is exactly why protecting the underlying key matters as much as it does.","Whether a specific token expires or needs periodic renewal depends on how the underlying key was issued — that's a detail of key management, not a universal property of bearer tokens as a mechanism. What's constant is the transport pattern itself: the token rides in the request's Authorization header, on every call, rather than through a separate session or cookie."],"commonMistakes":["Confusing the bearer token (the transport mechanism) with the API key (the actual credential it carries) — related, but not the same thing.","Assuming every bearer token is inherently short-lived — whether it expires depends on how the underlying key was issued, not a universal rule.","Underestimating what possessing a valid bearer token grants — \"bearer\" means whoever holds it is trusted as the party it represents, no further check involved."],"category":"ai-mcp","questions":[{"question":"Is a bearer token the same as an API key?","answer":"Not quite — the API key is the actual secret credential. The bearer token is the mechanism that carries it on each request, typically in an Authorization header."},{"question":"Does a bearer token expire automatically?","answer":"That depends on how the underlying key was issued — it isn't a universal property of the mechanism itself."}],"url":"/glossary/bearer-token","relatedTo":[{"id":"concept:api-key","relationship":"related","weight":0.9,"api":"/api/knowledge/concept%3Aapi-key"},{"id":"concept:mcp-server","relationship":"related","weight":0.9,"api":"/api/knowledge/concept%3Amcp-server"},{"id":"concept:tenant-isolation","relationship":"related","weight":0.9,"api":"/api/knowledge/concept%3Atenant-isolation"},{"id":"guide:what-is-mcp","relationship":"references","weight":0.7,"api":"/api/knowledge/guide%3Awhat-is-mcp"}],"referencedBy":[{"id":"concept:mcp-server","label":"MCP Server","url":"/glossary/mcp-server"},{"id":"concept:api-key","label":"API Key","url":"/glossary/api-key"}],"license":"https://creativecommons.org/licenses/by/4.0/","attribution":"BalanceMCP — https://balancemcp.com"}