What is a bearer token?
Quick answer
A bearer token is a secret string, usually your API key, that you send with each API request in a header called Authorization, written as the word Bearer, a space, then the key. Whoever holds the token can use the account, so it is treated like a password.
Last updated
Take the free module →Module 16 of the free n8n Jump Start course, about 9 minutes. No account needed.
Updated · By Robert Breen
Why it matters for a small business
Every paid data service needs to know who is calling, so it can charge the right account and turn away strangers. The risky part is where the key travels. Paste it into a web address and it lands in browser history, server logs, screenshots and every exported copy of the workflow. One leaked key can run up charges on a prepaid balance before anyone notices.
Sending the key as a bearer token in the Authorization header keeps it out of the address and the body. In n8n you go one step further and store it in a saved credential, so the workflow only points at the credential and the key itself never appears on the canvas. Ops teams can share and export workflows without sharing the secret.
The HTTP Request settings in the lesson
| Field | Value |
|---|---|
| Method | POST |
| URL | https://prolevelmax.com/v1/run |
| Authentication | Generic Credential Type |
| Generic Auth Type | Bearer Auth |
| Bearer Token (in the credential) | Your ProLevelMax API key |
In a real lesson: ProLevelMax in n8n: Keep Your Reddit Workflow Alive After the RSS Shutdown
In the ProLevelMax Reddit lesson, Maya Chen at Tallgrass Books (made up) creates a key under API keys in the ProLevelMax console. The lesson warns her never to paste it into the workflow itself, a chat or an email.
In the n8n HTTP Request node she sets Authentication to Generic Credential Type and Generic Auth Type to Bearer Auth, because ProLevelMax reads the key from an Authorization: Bearer header. She chooses Create new credential, pastes the key into Bearer Token and saves it, renamed ProLevelMax. n8n stores it encrypted and adds the header to every request. The Litescrape lesson moves a search API key out of the URL into the same kind of credential.
Try this lesson free or read the step-by-step guide.
Common confusions
Bearer token vs API key
The API key is the secret itself. Bearer is one way of sending it: in the Authorization header with the word Bearer in front. Other APIs ask for the same key in a custom header or a query parameter.
Bearer token vs n8n credential
A credential is where n8n stores the secret. Bearer Auth is the credential type that turns it into the right header on each call.
Bearer token vs OAuth
With OAuth you sign in and approve access, and the app gets a token that expires. In this lesson the token is simply a key you created and paste in once.
Tips
- Make one credential per service and reuse it in every workflow that calls it.
- If a key shows up in a screenshot or a shared file, remove it in the console and make a new one.
- Give each key a clear name so you know which workflow uses it.
Related terms
More n8n and automation terms
Where you use it: free lessons
- ProLevelMax in n8n: Keep Your Reddit Workflow Alive After the RSS Shutdown (n8n, 9 min)
- Litescrape in n8n: Swap SerpApi for a Cheaper Search API (n8n, 7 min)
- Add AI to Make.com: ChatGPT Writes a Personal Reply, Gmail Sends It (Make, 18 min)
- n8n: Call Any API with the HTTP Request Node (n8n, 9 min)
AI tools that use it
Frequently asked questions
- Is a bearer token the same as an API key?
- Often it is the same string. The key is the secret, and bearer is the way you send it, in the Authorization header after the word Bearer.
- Where do I put a bearer token in n8n?
- In the HTTP Request node, set Authentication to Generic Credential Type, choose Bearer Auth, create a credential and paste the key into Bearer Token.
- What happens if someone gets my bearer token?
- They can make calls on your account until you remove the key. Delete it in the provider's console, create a new one and update the credential.