bearer token
A string a client sends with each request to prove it has logged in; whoever holds it is let in.
A bearer token is a credential presented in the Authorization header; possession alone authorizes the request, so it must be short-lived and sent only over TLS.
Examples
After the phone logs in at
POST /auth/token, it sendsAuthorization: Bearer <token>on every request, and anyone who copies that string gets in until it expires.
See also