undefined | Better HN

0 pointspbreit4y ago0 comments

Isn't that just fancy phrasing for a username/password?

Most APIs just have you set a key in the "Authorization" header. I don't get what value the "Bearer " prefix adds.

That RFC is strange and seems it can be summarized in one line:

Include header "Authorization: Bearer [API key]" for authenticating API calls.

0 comments

2 comments · 2 top-level

The specified (rfc7235) syntax of the Authorization header is that it starts with an authentication scheme, followed by the parameters for that scheme. "Bearer" is one of those schemes. "Basic" and "Digest" are others.

dreyfan4y ago

> Isn't that just fancy phrasing for a username/password?

Not quite. username/password authenticate who or what something is; bearer tokens permit what actions can be taken by the holder of that token, and tend to be short-lived in nature and ideally for very specific actions.

j / k navigate · click thread line to collapse