Hacker News new | ask | show | jobs
by pbreit 1702 days ago
Isn't that just fancy phrasing for a username/password?

Most APIs just have you set a key in the "Authorization" header. I don't get what value the "Bearer " prefix adds.

That RFC is strange and seems it can be summarized in one line:

Include header "Authorization: Bearer [API key]" for authenticating API calls.
2 comments
jorams 1702 days ago
The specified (rfc7235) syntax of the Authorization header is that it starts with an authentication scheme, followed by the parameters for that scheme. "Bearer" is one of those schemes. "Basic" and "Digest" are others.
link
dreyfan 1702 days ago
> Isn't that just fancy phrasing for a username/password?

Not quite. username/password authenticate who or what something is; bearer tokens permit what actions can be taken by the holder of that token, and tend to be short-lived in nature and ideally for very specific actions.

link