Bearer token
Token where "whoever holds it can use it" — no key exchange required. The cash-in-a-wallet model. RFC 6750.
Header format: Authorization: Bearer <token>. Must always be sent over TLS — without encryption, anyone mid-network could steal the token and gain full access. Alternative: sender-constrained tokens (DPoP, mTLS-bound) where the server verifies the token came from the right client via a cryptographic binding (proof-of-possession). Most common in 2024 is still just bearer + short TTL.