The Authorization request header carries client authentication credentials to the server, allowing the user agent to authenticate against protected resources.

Authorization header syntax

The header consists of an authentication scheme followed by credentials or token parameters:

Authorization: <type> <credentials>

Common authentication schemes

  • Bearer Token (RFC 6750): Widely used in OAuth 2.0 and JWT authentication. 
    Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
  • Basic Authentication (RFC 7617): Base64-encoded username and password (username:password). 
    Authorization: Basic dXNlcm5hbWU6cGFzc3dvcmQ=
  • API Key Schemes: Custom API token prefixes configured by specific API providers.

Authorization and CORS preflight

The Authorization header is not a CORS-safelisted request header.

When a browser makes a cross-origin request including an Authorization header, it will automatically issue an OPTIONS preflight request. The server must explicitly include Authorization in its Access-Control-Allow-Headers response header, otherwise the browser will reject the response.

For a detailed guide on resolving CORS preflight issues with authentication, see our dedicated guide on Authorization Header Not Allowed in CORS.

Common integration mistakes

  1. Omitting the ‘Bearer’ prefix: Sending a raw token without the Bearer prefix causes backend token extractors to fail parsing.
  2. Exposing credentials in query parameters: Transmitting API keys in URLs (?token=xyz) exposes tokens in server access logs and browser history. Always prefer the Authorization header over HTTPS.
  3. Missing WWW-Authenticate challenge: When authentication fails, the server should return a 401 response accompanied by a WWW-Authenticate header.

How to verify the header with curl

Inspect the sent and received headers using curl:

curl -i https://api.example.test/v1/profile \
  -H "Authorization: Bearer test_jwt_token_123"

Key takeaway

The Authorization header is the standard HTTP request header for transmitting authentication tokens and credentials. Always transmit it over secure HTTPS connections, ensure the scheme prefix (such as Bearer) matches the server expectations, and configure CORS Access-Control-Allow-Headers when calling APIs from browser applications.