Bearer token
A bearer token is an opaque string an HTTP client sends in the Authorization header to authenticate a request. Whoever holds (bears) the token gets the access. For AI agents, bearer tokens authorize tool calls against external APIs.
Why it matters
Bearer tokens are the dominant authentication pattern for modern HTTPS APIs. The pattern: when the API issues credentials, it issues an opaque string; when the client makes a request, it sends Authorization: Bearer <token>; the API checks the token against its database and authorizes (or rejects) the request. Simple, fast, stateless.
For AI agents, bearer tokens matter because they are how the agent authorizes tool calls. When the user connects a custom tool to the agent, the user provides the URL and the bearer token. The agent stores the token (encrypted), retrieves it on every tool call, and includes it in the request header.
The simplicity of bearer tokens is also the security trade-off: a leaked bearer token gives full access until it is revoked. The mitigations are short token lifetimes, scope-restricted tokens, and proper rotation. Production systems treat bearer tokens like passwords; encrypted at rest, never logged, rotated on suspicion of compromise.
How Ajeris handles this
When users wire a custom MCP server into Ajeris, they provide the bearer token alongside the URL. Tokens are stored encrypted at rest using industry-standard symmetric encryption. The agent retrieves the token at call time, includes it in the Authorization header, and never exposes it in logs or to other users.
Tokens can be rotated by the user at any time through the manage page. Rotation invalidates the old token immediately; subsequent tool calls use the new one.
