Send a bearer token

Most APIs today authenticate with a bearer token: a string you send in the Authorization header, prefixed with the word Bearer. The name is literal. Whoever bears the token gets the access — there is no password prompt, no second factor, nothing else. A bearer token grants its holder authority, so treat it like a password with the exact scope and lifetime assigned by the service.

That framing drives everything in this lesson. Sending the token is one line. Keeping it from leaking is the actual skill.

Send the header

Read a disposable token from an environment variable:

export LAB_API_TOKEN='demo-token-for-practice'
curl --header "Authorization: Bearer $LAB_API_TOKEN" https://api.lab.test/profile

The shell expands the variable before curl runs, so the header arrives as Authorization: Bearer demo-token-for-practice. The token is absent from the script file, which is the point: scripts get committed, and grepping a repository for Bearer finds leaked credentials depressingly often.

You can verify the header reaches a server with a public echo endpoint:

curl --header "Authorization: Bearer $LAB_API_TOKEN" https://httpbin.org/bearer

A response of {"authenticated": true, "token": "demo-token-for-practice"} proves the exact header the server saw. If the API you are really calling returns 401 Unauthorized, and this echo check shows the header intact, the problem is the token itself — expired, wrong scope, wrong environment — not your curl command.

Where tokens still leak

The environment variable keeps the token out of your script, but it may still appear in process inspection or debug output. Know the escape routes:

Shell history records commands where you pasted the token literally. set -x in a script prints every expanded command, token included. Verbose curl output (-v) prints the Authorization header. Screenshots and pasted terminal output carry whatever was on screen.

Avoid all of those around real credentials. And do not use a real token in this lab — the echo endpoint reflects the token back in plain text, which is exactly what you never want happening to a credential that works somewhere.

When a token does leak, revoke it at the service and issue a new one. Rotating is cheap. Hoping nobody saw it is not a strategy.