Authentication · Request header

Authorization

Credentials for authenticating the request.

What is Authorization?

Authorization carries the credentials the server uses to identify the caller — typically a Bearer token, Basic base64(user:pass), or a signed AWS Signature.

Typical usage

Sent by clients on requests that require authentication.

Examples

OAuth 2.0 / JWT

Authorization: Bearer eyJhbGciOiJIUzI1NiI...

HTTP Basic

Authorization: Basic dXNlcjpwYXNz

Common gotchas

Basic authentication is only Base64 encoded — never a substitute for TLS. Always require HTTPS when accepting Authorization.

Also known as

Also commonly written as: authorization header · http authorization · bearer token header · authorization bearer · authorization basic · auth header · Authorization ヘッダ. These variants — including plural forms, unhyphenated spellings, and Japanese (ヘッダ) — all refer to the same Authorization HTTP header.

Specification

RFC 9110 §11.6.2

Frequently asked questions

What is the Authorization HTTP header?

Authorization carries the credentials the server uses to identify the caller — typically a Bearer token, Basic base64(user:pass), or a signed AWS Signature.

Is Authorization a request or response header?

Authorization is a request header — the client sends it to the server. Sent by clients on requests that require authentication.

What does a Authorization header look like?

A typical Authorization header looks like: Authorization: Bearer eyJhbGciOiJIUzI1NiI... (OAuth 2.0 / JWT).

What are common mistakes with Authorization?

Basic authentication is only Base64 encoded — never a substitute for TLS. Always require HTTPS when accepting Authorization.

Related headers

WWW-Authenticate

Tells the client which authentication scheme(s) are expected.

Strict-Transport-Security

Force browsers to use HTTPS for a domain (HSTS).

Set-Cookie

Sends a cookie to be stored by the client.

Content-Security-Policy

The primary defense against XSS: whitelist trusted sources.

X-Content-Type-Options

Disables MIME-type sniffing.

All cookies stored by the browser for this origin.

Access-Control-Allow-Origin

Which origins may read this response cross-origin.

Referrer-Policy

Controls the Referer header sent on outgoing links and requests.

Work with this header

JWT Decoder →Inspect a Bearer token from the Authorization header.JWT Generator →Sign a JWT to send in Authorization.cURL Converter →Turn a curl command into fetch / code and back.URL Parser →Break a URL into scheme, host, path and query.