Authorization

What the Authorization header does

Authorization carries the credentials that authenticate a request — most commonly Bearer <token> for API tokens/JWTs, or Basic <base64> for basic auth. Always send it over HTTPS, since anyone who sees the header can reuse the credentials.

Example

Authorization: Bearer <token>

Authorization in practice

Bearer token with curl

curl -H "Authorization: Bearer $TOKEN" https://api.example.com/me

Common Authorization questions and problems

What does the format look like?

A scheme followed by credentials: Authorization: Bearer <token> for OAuth/JWT tokens, or Authorization: Basic <base64 of user:password>. Basic is only safe over HTTPS.

Why do I get 401 even though I send the header?

The token may be expired or issued for another audience, the scheme name may be wrong, or a proxy or CDN may strip the header. Check the token's claims and the WWW-Authenticate response header.

Why does Authorization cause a CORS preflight?

A cross-origin request with Authorization is not CORS-safelisted, so the browser sends a preflight. The server must list Authorization in Access-Control-Allow-Headers. The wildcard does not cover it.

Authorization vs related headers

• WWW-Authenticate: WWW-Authenticate is the server's challenge that tells the client which scheme to use.
• Cookie: Cookie carries session credentials set by the server. Authorization carries credentials the client adds itself.

Where it's used

Authorization is a request header. Request headers are sent by the client to describe the request and what the client can accept.

Other request headers