Bearer token

A bearer token (hordozó token) is an API access token that grants whoever holds it ("the bearer") the right to access protected resources without any other proof of identity — mere possession is enough, like cash. It is transmitted in the HTTP header Authorization: Bearer <token>. In OAuth 2.0: bearer tokens are the standard format for access tokens; they are usually short-lived and carry scopes that limit what the bearer can do. Certyneo''s REST API uses bearer tokens to authenticate programmatic calls: creation of envelopes, status inquiry, webhook configuration and download of signed documents. Security issues: since the token is the identifier, it must only travel over TLS, never be exposed on the client side or logged, and be renewed regularly; a leaked bearer token is as dangerous as a leaked password until its expiration or revocation. Best practice: limit each token to strictly necessary permissions, set a short expiration and prefer one token per integration so you can revoke one without affecting the others.