Authorization Header

Carries credentials or an access token for a protected request.

Use a documented authentication scheme such as Bearer and keep credentials out of URLs, logs, and referrer data.

httpauthheader

Reference (http)

Authorization: Bearer <access-token>

Use a documented authentication scheme such as Bearer and keep credentials out of URLs, logs, and referrer data.

Common mistakes

Returning credentials in query parameters or accepting tokens without checking issuer, audience, expiry, and scope.

IANA registry: http-fields/field-names

Sources