skills.rest
maronnjapan
maronnjapanCOMMUNITY
Explore all skills by this author →
GitHub

oauth21-bearer-token

Transmit and validate OAuth 2.1 Bearer tokens via Authorization headers with TLS enforcement.

Updated Aug 23, 2026
Search Tags:#authentication#oauth#api-security#bearer-token#oauth2.1#token-validation#authorization-header
One-click install
npx skills add https://github.com/maronnjapan/maronn-openid-provider --skill oauth21-bearer-token
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: oauth21-bearer-token
Source: https://github.com/maronnjapan/maronn-openid-provider/tree/main/.claude/skills/oauth21-bearer-token
Command: npx skills add https://github.com/maronnjapan/maronn-openid-provider --skill oauth21-bearer-token

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Bearer tokens must be transmitted securely and validated correctly to protect resource servers and prevent token leakage. This guide defines how to properly transmit bearer tokens, enforce TLS, and prevent token leakage in OAuth 2.1 contexts.

Core Features & Use Cases

  • Correct token transmission via Authorization header with case-insensitive Bearer prefix.
  • Guidance against using query parameters for tokens and when to use form-encoded bodies.
  • Token validation steps and security requirements (TLS, audience, scope, and revocation considerations).
  • Use case examples for resource servers and clients enabling secure access.

Quick Start

Attach a valid Bearer token to the Authorization header in your API requests to protect access to resources.

Frequently Asked Questions about oauth21-bearer-token

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I securely transmit OAuth 2.1 bearer tokens in API requests?▼

OAuth 2.1 prohibits passing bearer tokens in query parameters to prevent leakage. You should transmit tokens exclusively via the Authorization header, or use form-encoded bodies only in specific permitted contexts.

What validation steps are required for OAuth 2.1 bearer tokens on a resource server?▼

Resource servers must validate bearer tokens by enforcing TLS, checking token structure, verifying audience and scope requirements, and handling token revocation to protect API resources from unauthorized access.

Why should I avoid passing bearer tokens in URL query parameters?▼

Passing bearer tokens in query parameters exposes them in server logs and browser history, causing token leakage. OAuth 2.1 prohibits this, requiring the Authorization header for secure resource requests.

Does OAuth 2.1 require TLS for bearer token transmission?▼

Yes, OAuth 2.1 strictly enforces TLS for bearer token transmission to protect tokens in transit and prevent interception when clients access protected resources on web APIs.

Can I use form-encoded bodies to send bearer tokens instead of the Authorization header?▼

You can use form-encoded bodies for bearer token transmission in specific permitted contexts, but the Authorization header remains the primary secure method for OAuth 2.1 resource requests.

Related Skills

Explore More Software Engineering Skills→
novvoonovvoo

oauth

Implement OAuth 2.0/2.1 authorization flows in Fastify applications.

Community
Advanced
7a336e6e7a336e6e
1

managing-sessions-tokens

Manage JWT authentication sessions with rotating refresh tokens and revocation.

Community
Advanced
camilooscargbaptistacamilooscargbaptista
7

api-gateway-patterns

Design API gateway architectures with rate limiting, authentication, routing, and circuit breaking.

Community
Intermediate
auth0auth0
40

auth0-dpop

Bind access tokens to a client-held key pair with DPoP.

Official
Advanced