Bearer token Authorization header: format and examples

Q: What is the header name for a bearer token?

Authorization. The value is 'Bearer ', for example: Authorization: Bearer abc123.

The header is named Authorization, and its value is the word Bearer, one space, then the token.

1. The format

Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjMifQ.abc

Header name: Authorization (header names are case-insensitive).
Value: Bearer, a single space, then the token exactly as you received it. No quotes, no colon after Bearer, no Token prefix unless the API documents one.
If the token is a JWT (three parts separated by dots), you can read its claims, such as the expiry date, with the free local JWT decoder.

2. Examples (all tested)

curl, two equivalent ways:

curl -H "Authorization: Bearer $TOKEN" https://api.example.com/me
curl --oauth2-bearer "$TOKEN" https://api.example.com/me

Python requests:

import requests
r = requests.get("https://api.example.com/me", headers={"Authorization": f"Bearer {token}"})

Python standard library:

import urllib.request
req = urllib.request.Request("https://api.example.com/me", headers={"Authorization": f"Bearer {token}"})
data = urllib.request.urlopen(req).read()

JavaScript fetch (browser or Node 18+):

const res = await fetch("https://api.example.com/me", { headers: { Authorization: `Bearer ${token}` } });

3. Redirects: where does your token go?

When the server answers with a redirect, the client decides whether to send the token again. We redirected each client once to the same host and once to a different host:

Client	Redirect, same host	Redirect, other host
curl `-L`	Token sent	Dropped
curl `-L --location-trusted`	Token sent	Sent
Python requests	Token sent	Dropped
Python urllib.request	Token sent	Sent
Node fetch	Token sent	Dropped

So urllib forwards your token to whatever host a redirect points to. If you use urllib with tokens and don't control the server's redirects, call trusted URLs only. Prefer requests, or check the final URL. And if an API "loses" your token after a redirect in curl, requests or fetch, call the final URL directly instead of turning on --location-trusted.

4. Common mistakes

Missing the "Bearer " prefix, or sending Bearer: token. Most APIs answer 401.
Extra whitespace or a newline at the end of a token read from a file. Strip it (token.strip(), $(tr -d '\n' < token.txt)).
Tokens in URLs (?access_token=…) end up in server logs and browser history. Use the header.
Pasting real tokens into online tools. Use a local decoder, and treat tokens like passwords.

Frequently asked questions

What is the header name for a bearer token?

Authorization. The value is 'Bearer <token>', for example: Authorization: Bearer abc123.

Is 'Bearer' case-sensitive?

The standard says the scheme name is case-insensitive, but some servers only accept 'Bearer' with a capital B. Always send it that way.

How do I send a bearer token with curl?

curl -H "Authorization: Bearer $TOKEN" URL, or curl --oauth2-bearer "$TOKEN" URL. Both sent the same header in our test.

Does Python's urllib keep the Authorization header on redirects?

Yes, even to a different host, in our test. requests, curl and Node fetch dropped it when the host changed.

Written with AI assistance. Every example was sent to a local echo server on 2026-10-01 (curl 8.14.1, Python 3 urllib, requests 2.32.3, Node 24 fetch), including redirects to the same host and to a different host. PlainHeaders is our extension; the other methods are free.