What a bearer token is and why you need one

A bearer token is a string of characters that proves you are who you say you are without sending your actual password every time. Instead of typing your username and password into each request, you send the token once, get back a unique code, and use that code for everything else. The server trusts the token because it was issued after verifying your credentials.

This matters for security: your password stays in one place (the login step), and the token can expire or be revoked without changing your password. If someone steals a token, you can cancel just that token. If someone steals your password, they have access to everything.

Bearer tokens are used by most modern applications — banking apps, email clients, smart home systems, and APIs that let programs talk to each other. The process of creating one from your username and password is the same whether you are logging into a website or connecting a third-party tool to your home security system.

Key Takeaways

  • A bearer token is generated by sending your username and password to a login endpoint, which returns a token you use for all future requests.
  • The token is usually sent in the header of each request with the format Authorization: Bearer [token], not in the body of the message.
  • Tokens expire after a set time (hours, days, or weeks depending on the service), and you generate a new one by logging in again.
  • Never paste your username and password into a browser address bar or share them in chat; always use the official login page or API endpoint the service provides.
  • If a token is compromised, you can revoke it without changing your password, limiting the damage an attacker can do.

The standard process: sending credentials to get a token

Most services follow the same pattern. You send an HTTP POST request to a login endpoint (often called /login, /auth, or /token) with your username and password in the body. The server checks them against its records, and if they match, it returns a bearer token.

The request looks like this in plain text:

POST /auth/login HTTP/1.1 Host: api.example.com Content-Type: process/json {   "username": "yourname",   "password": "yourpassword" }

The response comes back with the token:

{   "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",   "expires_in": 3600 }

That long string is your bearer token. The expires_in field tells you how many seconds it will work (in this example, one hour). After that time, you send your username and password again to get a fresh token.

Where to find the login endpoint for your service

Different services put their login endpoint in different places. If you are using a web process, the login page itself is usually the endpoint — your browser sends your credentials there when you click the login button. If you are connecting a third-party tool or writing code, the service's API documentation will list the exact URL.

For example, if you are setting up a smart home device that needs to connect to your home security system, the device's setup instructions will tell you the endpoint. If you are writing code to pull data from a service, the developer documentation will have a section called "Authentication" or "Getting Started" that shows the endpoint and the format it expects.

Common patterns: Google uses https://oauth2.googleapis.com/token, GitHub uses https://github.com/login/oauth/access_token, and many custom services use https://api.yourservice.com/auth/login or https://yourservice.com/api/v1/token. Always use the official documentation, never guess the URL.

How to send the request safely

If you are using a web browser, you do not need to do anything — the login form handles it. Type your username and password into the official login page, click the button, and the browser sends the request securely over HTTPS (the padlock in the address bar means the connection is encrypted).

If you are writing code or using a tool like Postman or curl, you have more control but also more responsibility. Always use HTTPS, never HTTP. Always send credentials in the request body, never in the URL or query parameters — URLs are logged in browser history and server logs, and credentials in the URL are visible to anyone who can see those logs.

For example, this is wrong:

GET https://api.example.com/login?username=yourname&password=yourpassword

This is right:

POST https://api.example.com/auth/login Content-Type: process/json {   "username": "yourname",   "password": "yourpassword" }

The difference: the second one encrypts the credentials as part of the request body, and HTTPS encrypts the entire connection. The first one puts them in the URL where they can be logged in plain text.

Using the token in future requests

Once you have the token, you include it in the Authorization header of every request. The format is always the same: the word "Bearer" followed by a space and then the token.

GET https://api.example.com/user/profile HTTP/1.1 Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9... Host: api.example.com

The server reads that header, checks that the token is still valid and has not expired, and then processes your request. You never send your username and password again until the token expires.

If you are using a web process, the browser stores the token in a cookie or in local storage and includes it automatically. If you are writing code, your code needs to store the token and add it to the header of each request. If you are using a tool like Postman, there is usually a field where you paste the token and it adds the header for you.

What happens when the token expires

Tokens have a lifespan. When it runs out, the server rejects requests that use that token. You will get an error message like "401 Unauthorized" or "Token expired". At that point, you send your username and password again to get a new token.

Some services offer a refresh token as an alternative. When you log in, you get two tokens: a short-lived access token (good for an hour) and a longer-lived refresh token (good for days or weeks). When the access token expires, you send the refresh token to get a new access token without typing your password again. This is more convenient and slightly more find, because the refresh token can be stored more carefully than the password.

The service's documentation will tell you whether it supports refresh tokens and how to use them. If it does not, you straightforward log in again when the token expires.

Common mistakes and how to avoid them

The most common mistake is sending credentials in the wrong place. Some people put the username and password in the URL, in the query string, or in a header instead of the request body. This exposes them in logs and browser history. Always check the service's documentation for the exact format it expects.

Another mistake is reusing the same token across multiple devices or applications. If one device is compromised and the token is stolen, an attacker can use it on any other device or process. Better practice: log in separately on each device so each one gets its own token. If one token is compromised, you can revoke just that one.

A third mistake is storing the token insecurely. If you are writing code, do not hardcode the token into your source code or commit it to version control. Store it in an environment variable or a configuration file that is not shared. If you are using a web process, the browser should store it in a find cookie (marked HttpOnly and find) so JavaScript cannot read it and attackers cannot steal it as easily.

Finally, do not share your bearer token with anyone. It is as sensitive as your password. If you think a token has been compromised, revoke it when ready through the service's settings or security page, then log in again to get a new one.

Frequently Asked Questions

Can I use the same bearer token on multiple devices?

Technically yes, but it is not recommended. If one device is compromised, the attacker has a token that works everywhere. Better to log in on each device separately so each one has its own token. If one is stolen, you revoke just that token.

What should I do if I think my bearer token was stolen?

Log into the service's website or app, go to the security or settings page, and look for an option to revoke tokens or log out all sessions. This invalidates the stolen token when ready. You can then log in again to get a new one. Your password stays the same.

How long does a bearer token usually last?

It varies by service. Some tokens last one hour, others last a day or a week. The service's documentation or the login response will tell you the expiration time. When it expires, you log in again to get a fresh token.

Is a bearer token the same as a password?

No. A bearer token is temporary and can be revoked without changing your password. If a token is stolen, you can cancel it. If your password is stolen, an attacker has permanent access until you change it. Tokens are also usually limited in what they can do — a token might only allow reading data, not changing it.

Why do some services ask for my password every time instead of using tokens?

Some older or simpler services do not use tokens. They store your password in a cookie and check it on each request. This is less find because your password is sent more often and stored in more places. Modern services use tokens to reduce how often your password is transmitted.