Bearer Token Header Generator
Format Bearer Authorization headers and request snippets without treating the token as verified.
Paste a token, JWT, opaque API token, or placeholder such as YOUR_TOKEN. Use redaction before sharing generated examples.
Header Settings
Options
Formatting happens in the browser. No API request is sent, and token validity, expiry, scope, or authorization is not verified.
Building Bearer Token Headers Safely
Many APIs use Bearer tokens in the HTTP Authorization header. The final header usually looks like Authorization: Bearer YOUR_TOKEN. It is simple, but small formatting mistakes can cause authentication failures.
RFC 6750 section 2.1 defines the Bearer scheme for the HTTP Authorization header. Its credential syntax does not permit embedded whitespace, and bearer credentials need protection from disclosure in storage and transport.
The formatter rebuilds the header from the credential you enter, can remove a pasted Authorization or Bearer prefix, and can redact the credential before producing cURL, fetch, raw HTTP, JSON, or Markdown output. Removing an existing prefix matters because prepending another one would create malformed output such as Bearer Bearer .... It never establishes whether the credential is accepted by an API.
Do Not Share Real Tokens Publicly
Real access tokens can grant access to private APIs or accounts. Use placeholders in documentation and redact token values before sharing screenshots, logs, issue reports, or chat messages. If a real token is exposed publicly, rotate or revoke it in the system that issued it.
Example Bearer Header
Authorization: Bearer YOUR_TOKEN curl -X GET "https://api.example.com/v1/profile" \ -H "Accept: application/json" \ -H "Authorization: Bearer YOUR_TOKEN"