3 ms·
A security token with the property that any party in possession of the token (a "bearer") can use the token in any way that any other party in posse
by tobyjsullivan 5y ago
A security token with the property that any party in possession of
the token (a "bearer") can use the token in any way that any other
party in possession of it can. Using a bearer token does not
require a bearer to prove possession of cryptographic key material
(proof-of-possession).
I think most people interpret that definition as including API secret keys. I’d be curious to hear any alternative suggestions as I run into this fairly regularly.
https://datatracker.ietf.org/doc/html/rfc6750#section-1.2 https://datatracker.ietf.org/doc/html/rfc6750#section-1.2
Also relevant: https://developer.mozilla.org/en-US/docs/Web/HTTP/Authentication#authentication_schemes https://developer.mozilla.org/en-US/docs/Web/HTTP/Authentica...