How Authorization works
The value starts with a scheme name. Bearer carries an OAuth access token or a JWT; Basic carries username:password in Base64, which is encoding, not encryption, so it is only safe over HTTPS. Shared caches don’t store responses to requests with Authorization unless the response explicitly allows it.
Values
| Value | Meaning |
|---|---|
Bearer <token>
|
OAuth 2.0 access tokens, JWTs and API keys. |
Basic <base64(user:password)>
|
Username and password. Browsers show a login dialog for it. |
Digest …
|
Challenge-response with hashed credentials; rare today. |
AWS4-HMAC-SHA256 …
|
Signed requests for AWS APIs. |
Examples
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjMifQ.abcAuthorization: Basic YWRhOnMzY3JldA==Common mistakes
- Browsers and HTTP clients drop Authorization when following a redirect to another host, so a redirect from api.example.com to www.example.com loses the token.
- Keep it out of logs: many reverse proxies and APM tools record request headers by default.
Check it
# Show the request headers curl sends (lines starting with >)
curl -sv -o /dev/null https://example.com 2>&1 | grep '^>'Paste a full set of response headers into the HTTP header checker to get every header explained and common mistakes flagged.
Related headers
- WWW-Authenticate: sent with 401 Unauthorized, tells the client which authentication scheme to use.
- Cookie: sends the browser’s stored cookies for this site back to the server.
- Access-Control-Allow-Headers: lists the request headers a cross-origin request may send, in answer to a preflight.
Sources
Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.
Frequently asked questions
What does the Authorization header do?
The Authorization request header carries the client’s credentials: a bearer token, Basic username and password, or another scheme. The value starts with a scheme name. Bearer carries an OAuth access token or a JWT; Basic carries username:password in Base64, which is encoding, not encryption, so it is only safe over HTTPS. Shared caches don’t store responses to requests with Authorization unless the response explicitly allows it.
How do I see the Authorization header?
Open your browser’s dev tools, select a request in the Network tab and look under Request Headers. On the command line, "curl -v https://example.com" prints the request headers it sends, marked with ">".