Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

If a token is not a JWT is it really a “Bearer” token?


"Bearer" and JWT are orthogonal. Tokens in other format or stateful formats can be bearer tokens, while JWTs can use non-bearer authentication methods. For instance, RFC 9449 (DPoP) describes an authentication method where you have to provide a PoP (based on JWS) in addition to an access token (which may or may not be JWT).


Bearer token just means whoever has the token string has the associated capability - like bearer bonds.

Unlike e.g. challenge-response or signature authentication.


Oauth defines bearers tokens without requesting them to be jwt.


yes, 100%




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: