APITesterThe command
curl -H "Authorization: Bearer $TOKEN" https://httpbin.org/bearer
Opens the request console with this request filled in. It is sent from api-tester.com's server rather than from your machine, so it shows what the endpoint returns, not how your own network or curl build behaves.
What the flags do
| Flag | What it does |
|---|---|
-H "Authorization: Bearer TOKEN" | The standard form. Scheme, one space, then the token. |
--oauth2-bearer TOKEN | Builds the same header for you. |
-v | Shows the request, including the header, to confirm what was sent. |
Keeping the token out of history
Pasting a token into the command stores it in shell history and exposes it in the process list. Put it in an environment variable and reference that in double quotes, so the shell expands it. Single quotes would send the literal text $TOKEN, which produces a 401 that looks like a bad token.
For tokens you fetch from a login endpoint, capture the value straight into the variable so it never appears on screen.
read -rs TOKEN # paste, no echo, not in history
export TOKEN
curl -H "Authorization: Bearer $TOKEN" https://api.example.com/me
TOKEN=$(curl -s -d "client_id=...&client_secret=..." \
https://auth.example.com/oauth/token | jq -r .access_token)Reading the failure
401 Unauthorized means the server did not accept the credential: missing header, malformed header, expired or revoked token. Its WWW-Authenticate response header often says which, for example error="invalid_token". 403 Forbidden means the token was accepted and identifies you, but lacks the permission or scope for this action. Getting a new token fixes the first and never the second.
curl -i -H "Authorization: Bearer $TOKEN" https://api.example.com/admin \
| grep -i -E "^(HTTP|www-authenticate)"Common mistakes
- The word
Beareris required, with exactly one space after it. Sending the token alone is the most common cause of a 401 with a valid token. - Stray whitespace or a newline copied along with the token breaks the header.
- Not every API uses this scheme. Some want
X-API-Key,Token, or the key as a Basic-auth username. Follow the API's own documentation.
Related curl examples
Curl Basic Auth Example
-u takes a username and password and turns them into an Authorization: Basic header.
Curl Send Header Example
-H adds a header line to the request.
Curl GET JSON Example
Fetching JSON is a GET with one header that says what you want back.
Curl HTTPS Request Example
An https:// URL is all curl needs to use TLS, and it verifies the server's certificate by default.
Bearer Tokens Explained
What the token is, how servers check it and why they reject it.
All Curl Examples
49 worked examples, grouped by what you are trying to do.
More under Authentication
References
- curl man page: --oauth2-bearer — Sending a bearer token without writing the header by hand.
- MDN: Authorization — The header's syntax for each authentication scheme.
These links leave api-tester.com, which is independent of the projects they point to.
FAQ
How do I send a bearer token with curl?
Add the header -H "Authorization: Bearer YOUR_TOKEN" to the request, or use --oauth2-bearer YOUR_TOKEN.
Why do I get 401 with a valid bearer token?
Usually the header is malformed: the word Bearer is missing, there is extra whitespace, or the token was placed in single quotes so a shell variable was not expanded.
What is the difference between 401 and 403 with a bearer token?
401 means the token was missing, invalid or expired. 403 means the token is valid but does not grant permission for the requested action.