Skip to main content
apiguide.dev

Authorization Header

Contains the credentials to authenticate the client with the server.

Header TypeRequest Header
SpecificationStandard RFC compliant
Associated CodesHTTP 401,HTTP 403

What is the Authorization header?

The Authorization request header carries credentials that authenticate the client request, granting access to protected API endpoints.

API Usage & Best Practices

  • Use the Bearer scheme: For modern token-based APIs (JWTs, OAuth2, API Keys), format the header as Bearer <token>.
  • Never transmit sensitive keys in query strings: Always pass credentials in the Authorization header to prevent them from being logged in proxy servers.
  • Shared caches skip authenticated responses: Per RFC 9111, a shared cache (like a CDN) must not store a response to a request that carried an Authorization header unless the response explicitly opts in with a directive such as public, must-revalidate, or s-maxage.

Examples

GET /v1/leads HTTP/1.1
Host: api.apiguide.dev
Authorization: Bearer api_key_abc123xyz

Associated HTTP Status Codes

HTTP 401 — Unauthorized

The request lacks valid authentication credentials. The client must authenticate.

View reference →

HTTP 403 — Forbidden

The client is authenticated but does not have access rights to the content.

View reference →

Sponsors

Support the project →