A bearer token is sent in an Authorization header as `Authorization: Bearer <token>` and authorises the request purely by being presented. There is no signature over the request, no proof the sender is the party the token was issued to: the token is the whole credential, which is what "bearer" means.
The server validates the token — by looking it up, or by verifying a signature if it is self-contained like a JWT — and derives the caller's identity and permissions from it. A missing or invalid token is a 401. A valid token whose holder is not allowed to do this particular thing is a 403; the difference matters, because only one of them can be fixed by getting a new token.
That a bearer token is safe to put in a URL because it expires. Anything in a URL ends up in server logs, browser history, referrer headers and analytics. Bearer tokens belong in a header, over TLS, with a short lifetime and a refresh mechanism.
Every endpoint marked with a lock takes `qa-admin-token` or `qa-viewer-token`. Using the viewer token on a DELETE is the cleanest way to see the 401/403 distinction: the token is valid, and the answer is still no.
All glossary terms · Testing techniques · All 39 mock REST APIs