Bearer token
A bearer token is a security token that its holder can present without proving possession of a separate cryptographic key bound to that token.
Possession is enough to present it
A bearer token does not require the caller to prove possession of a separate cryptographic key. A stolen, usable copy can therefore let someone make requests with the token’s access.
The API still checks whether the token is valid for it and whether the requested operation is allowed. “Bearer” does not mean unlimited access or acceptance after expiry.
OAuth bearer tokens are commonly sent in the HTTP Authorization header. They may be readable JWTs or opaque strings; the format does not determine whether a token is a bearer token.
A signature does not identify the caller
A signed token lets the recipient check its integrity and issuer. That signature does not establish that the person presenting the token is the client that originally obtained it. Sender-constrained tokens add a separate proof requirement.
Treat bearer tokens like credentials when handling logs, screenshots, and support bundles. Redact the token itself; record the intended API, relevant timestamps, and a safe reference instead. That gives an investigator useful context without creating another copy of a credential.