What is a Bearer Token?

Short answer

A bearer token is a token that is sent with the Authorization: Bearer <token> header and gives access to whoever carries it: if the server finds the token valid, it grants access without looking at who made the request (RFC 6750). Therefore, a stolen bearer token is as valuable as a password for its validity period; it is carried only over HTTPS and is kept short-lived. OAuth 2.0 access tokens are mostly used in this form. It is used in two places in TR7: in the AGS Backend SSO Configurations profile, the injection for which Type = Bearer Token is selected adds the value produced with Smart Variables in the Bearer Token field for the authenticated user to the application behind as an Authorization: Bearer … header; the header name can be changed with Header Name Override. In the OAuth2 and OpenID Connect providers, on the other hand, TR7 sends the access token it obtains to the user info endpoint with the Bearer header by default (User Info Request Method: GET with Bearer header).

Where It Is Used in TR7

Where	Field / label	What for
AGS → Integrations → Backend SSO Configurations	Injections → Type = Bearer Token; Bearer Token, Header Name Override	Passing the identity to the application behind with a token; a header with the same name coming from the client is removed first
AGS-enabled vService → Flowchart	Backend SSO Config	Binding the profile to the vService
AGS → Authentication → Authentication Providers (OAuth2, OpenID Connect; Custom Provider)	User Info Request Method: GET with Bearer header (default) or POST form parameters	How the access token is sent in the user info request

Common Misconceptions

• "A bearer token is bound to the user; if it is stolen, it is useless." Anyone who holds the bearer token can use it as long as the token is valid.
• "Bearer and Basic are the same header." Both use the Authorization header; Basic carries the username and password, while Bearer carries a token.
• "The Bearer Token injection in Backend SSO authenticates the user." The injection is added only to the requests of a user who has logged in to AGS; the authentication is done by the Authentication Provider step in the flow.

How it is done in the documentation

• Backend SSO Configurations · Type
• Backend SSO Configurations · Bearer Token
• OAuth2 · User Info Request Method

Related questions

• What is the difference between an access token and an ID token?
• What is a JWT (JSON Web Token); where is it used in TR7?
• What is SSO (Single Sign-On)?