Bearer Token
A bearer token is the mechanism by which an API key is actually presented on each request, typically in an Authorization header, proving the caller holds a valid credential without a separate login flow.
In short
The transport, not the credential itself. The API key is the secret; the bearer token is how that secret rides along on every single tool call, in an Authorization header, so the server can verify it on each request rather than requiring a fresh login every time.
Also called: authorization header
A bearer token is the specific way a credential gets presented on an HTTP request — carried in an Authorization header, typically as "Bearer <the key>" — so a server can verify the caller holds a valid credential without running a separate login exchange on every single call.
It's worth distinguishing this from the API key itself: the key is the actual secret, issued once and tied to a specific user's books. The bearer token is the mechanism that secret rides along on, request after request, proving possession of the key without re-authenticating from scratch each time.
"Bearer" describes the trust model plainly: whoever bears the token — presents it on a request — is trusted as the party it represents, the same way a bearer bond belongs to whoever's holding it. There's no additional check beyond possessing a valid token, which is exactly why protecting the underlying key matters as much as it does.
Whether a specific token expires or needs periodic renewal depends on how the underlying key was issued — that's a detail of key management, not a universal property of bearer tokens as a mechanism. What's constant is the transport pattern itself: the token rides in the request's Authorization header, on every call, rather than through a separate session or cookie.
What people get wrong
- Confusing the bearer token (the transport mechanism) with the API key (the actual credential it carries) — related, but not the same thing.
- Assuming every bearer token is inherently short-lived — whether it expires depends on how the underlying key was issued, not a universal rule.
- Underestimating what possessing a valid bearer token grants — "bearer" means whoever holds it is trusted as the party it represents, no further check involved.
Common questions
- Is a bearer token the same as an API key?
- Not quite — the API key is the actual secret credential. The bearer token is the mechanism that carries it on each request, typically in an Authorization header.
- Does a bearer token expire automatically?
- That depends on how the underlying key was issued — it isn't a universal property of the mechanism itself.
Machine-readable: /api/knowledge/concept:bearer-token