Bearer token

A bearer token is an API access token that grants whoever holds it ("the bearer") the right to access protected resources, without any other identity proof — possession alone is sufficient, like cash. It is transmitted in the HTTP header Authorization: Bearer <token>. In OAuth 2.0: bearer tokens are the standard access token format; they are generally short-lived and carry scopes that limit what the bearer can do. Certyneo''s REST API uses bearer tokens to authenticate programmatic calls: creation of envelopes, status queries, webhook configuration, and download of signed documents. Security concerns: since the token is the identifier, it must only travel over TLS, never be exposed client-side nor logged, and be renewed regularly; a leaked bearer token is as dangerous as a leaked password until its expiration or revocation. Best practice: limit each token to strictly necessary permissions, set a short expiration, and prefer one token per integration so you can revoke one without affecting others.