---
title: Authenticate with a Bearer Token
slug: authenticate-with-a-bearer-token
type: how-to
plugin: huxx-connect
summary: Configure Bearer Token authentication on an API so every request sends an Authorization Bearer header, with the token stored encrypted.
keywords: [bearer token, authorization header, authentication, credentials]
version_added: 1.2.5
version_updated: 1.2.5
level: intermediate
related: [understanding-authentication, authenticate-with-an-api-key, store-credentials-outside-the-database, authentication-types, debug-api-requests]
---

Bearer Token auth sends your token in the `Authorization` header of every
request the API makes. It's the scheme used by most modern APIs. This page
configures it on an existing API; if you haven't created one yet, start with
[Your first API connection](/docs/connect/tutorial/your-first-api-connection/).

> **Quick version:**
> 1. Go to **HuxxConnect → APIs** and click **Configure** on your API.
> 2. In **API Configuration**, set **Auth Type** to **Bearer Token**.
> 3. Paste your token into **Token (or constant name)**.
> 4. Click **Save API**.
>
> Every request now sends `Authorization: Bearer <your-token>`.

## Configure the API

:::novice
A bearer token is a secret string your API provider gives
you, usually from a dashboard page called "API keys" or "Tokens". Whoever
holds it gets access, so treat it like a password. Background:
[Understanding API authentication](/docs/connect/explanation/understanding-authentication/).
:::

1. Go to **HuxxConnect → APIs** and click **Configure** on the API.
2. In the **API Configuration** section, set **Auth Type** to
   **Bearer Token**.
3. A **Token (or constant name)** field appears. Paste the token exactly as
   the provider issued it — without any `Bearer ` prefix. HuxxConnect adds
   the prefix for you.
4. Click **Save API**. The token is encrypted before it is stored (see
   [Choose an encryption tier](/docs/connect/how-to/choose-an-encryption-tier/)).

<!-- screenshot-todo: api-detail--auth-bearer--token-field | alt: API Configuration section with Auth Type set to Bearer Token and the token field filled with a masked value -->

To keep the token out of the database entirely, enter an ALL_CAPS constant
name or an `env:VAR_NAME` reference in the same field — see
[Store credentials outside the database](/docs/connect/how-to/store-credentials-outside-the-database/).

## What gets sent

With the token field set to `hxc_example_token_123`
(`// Replace with your real token.`), every request to any
[endpoint](/docs/connect/explanation/glossary/#endpoint) of this API carries
the header:

```
GET /v2/reports HTTP/1.1
Host: api.example.com
Authorization: Bearer hxc_example_token_123
```

Source: `src/Auth/Providers/BearerTokenAuth.php` — the provider sets
`Authorization` to `Bearer ` followed by your token.

## Verify it works

Expand an endpoint on the same screen and click **Run Test**. A `200`
response with a body confirms the token is accepted. A `401` means the API
rejected it — see below.

## Advanced

- **Per-endpoint override** — if one endpoint needs different credentials
  (or none), expand that endpoint's **Authentication Override** accordion
  and enable the toggle. The override replaces the API-level auth for that
  endpoint only.
- **Filter the token at request time** — the
  `huxx_connect/auth/token` filter receives the token plus the API and
  endpoint context before the header is built, for rotation or per-request
  substitution schemes.

## If it didn't work

- **Response is `401` or `403`.** The API rejected the token. Check that you
  didn't paste it with a `Bearer ` prefix (HuxxConnect adds its own, so a
  pasted prefix sends `Bearer Bearer ...`), and confirm in the provider
  dashboard that the token is active and has the required scopes. Inspect
  the actual request in [Debug API requests](/docs/connect/how-to/debug-api-requests/).
- **The token field shows "Credentials could not be decrypted due to
  encryption key mismatch. Please re-enter your credentials."** The
  encryption key changed since the token was saved — common after moving or
  cloning a site. Re-enter the token and click **Save API**; to prevent a
  repeat, read [Choose an encryption tier](/docs/connect/how-to/choose-an-encryption-tier/).
- **One endpoint fails while others succeed.** Check that endpoint's
  **Authentication Override** accordion — an enabled override replaces the
  API-level token for that endpoint.