OAuth 2.0 Bearer Token Usage (RFC 6750)

1. Authenticated requests

   Sending bearer tokens in the Authorization header, form body or query.

2. The WWW-Authenticate response header

   Bearer challenge attributes realm, scope, error.

3. Error codes

   invalid_request, invalid_token and insufficient_scope.

4. Security threats

   Token manufacture/modification, disclosure and redirect.

5. Threat mitigation

   Protecting tokens in transit and at rest.

Each section links to the official page. Titles and summaries by Extra Credit; the docs belong to their authors.

• JSON Web Key and Algorithms (RFC 7517 and 7518)
• JSON Web Signature (RFC 7515)
• JSON Web Token (RFC 7519)
• Kerberos V5 (RFC 4120)
• LDAP (RFC 4510 series)
• OAuth 2.0 (RFC 6749)
• OAuth 2.0 Device Authorization Grant (RFC 8628)
• OAuth 2.0 Security Best Current Practice (RFC 9700)
• OAuth 2.0 Token Exchange (RFC 8693)
• OAuth 2.1 (IETF draft)
• OpenID Connect Core 1.0
• Passkeys