Because holding it is enough, send it only over TLS, keep it out of URLs and logs, and keep its lifetime short.
Bearer token
A token that grants access to whoever holds it, sent as `Authorization: Bearer <token>`.
Because holding it is enough, send it only over TLS, keep it out of URLs and logs, and keep its lifetime short.