How does a bearer token work?
A client gets a token, from an OAuth sign-in flow or by creating one in a dashboard, then sends it with each request as Authorization: Bearer followed by the token. The server checks the token and decides what the request may do. It asks for no other proof, which is what bearer means.
Tokens can be opaque random strings that the server looks up, or self-contained JSON Web Tokens (JWTs) that carry signed claims such as an expiry time. Bearer describes how a token is used, not its format.
RFC 6750’s advice follows from that design: always use TLS, keep tokens out of page URLs, don’t store them in cookies that can be sent unencrypted, and issue short-lived tokens, an hour or less, especially to clients running in a web browser.
Why do bearer tokens matter for a website voice agent?
Remote MCP servers and management APIs usually take a bearer token, so the token in a coding tool’s config is a working credential. Anyone who copies it from a shared file, a log or a screenshot can make the same requests until it’s revoked.
The widget side needs a different design, because anything in page code is visible to every visitor. A safe widget puts no long-lived token in the page and uses short-lived, single-use credentials for each call instead.
How Kawl Now uses bearer tokens
The Kawl Now REST API and MCP server both take a workspace token as a bearer token. Tokens are opaque random strings that start with hl_sk_, not JWTs, and the server checks each one against a stored hash.
Unlike the short-lived tokens RFC 6750 recommends for browsers, workspace tokens don’t expire, because they’re meant for server-side code and trusted tools. Keep them in environment variables rather than committed files, never in a web page, and revoke any you stop using.
Your page never holds a long-lived token. When a visitor starts a call, the widget script on your page fetches a short-lived call ticket and hands it to the call window. The ticket can start only one call and must be claimed within two minutes, and the dashboard signs you in with an HttpOnly, Secure cookie instead of a token.
GET /api/manage/workspace HTTP/1.1
Host: app.kawlnow.com
Authorization: Bearer YOUR_WORKSPACE_TOKENCommon questions
Is a bearer token the same as a JWT?
No. A JWT is a token format that carries signed claims, while bearer describes how a token is used: whoever presents it gets access. A JWT is often sent as a bearer token, but a bearer token can also be an opaque random string, as Kawl Now’s workspace tokens are.
Can a bearer token go in a URL?
It shouldn’t. RFC 6750 says bearer tokens should not be passed in page URLs, because browsers, servers and logs can record them. Send them in the Authorization header over HTTPS.