After login, a client often sends a header like Authorization: Bearer followed by a token. The server accepts any request carrying a valid one, without asking for a password or a second proof. The word bearer means exactly that: possession is enough.
That makes storage and transport the main risks. A token saved in browser local storage can be read by any injected script, and one placed in a URL can end up in logs, history and referrer headers. AI-built apps commonly do both, and often issue tokens that never expire.
Send tokens only over HTTPS and in the header, keep lifetimes short, refresh them through a safe flow, and revoke them on logout or suspected theft. For browser apps, consider an HttpOnly cookie instead of local storage. Bearer tokens are frequently JWTs, but the two words are not the same thing.
Authorization: Bearer <access_token>