<p>This one is about where the bearer token belongs.</p><p>In the last tip we put it in the authorization header, and we kept it out of the U R L. The next question is the body. Why not send the token in there, with the blog?</p><p>When we finish, you can say why the token stays in the header.</p><p>Post slash api slash blogs creates a blog. You send that blog in the body, as JSON. A title, and the text.</p><p>The token is not part of that blog. It proves who is asking. That proof goes in the authorization header. Authorization bearer, then the token.</p><p>A common junior mistake is to drop the token into the JSON, next to the title. The app builds the blog from that body, so the token can be saved on the post. The next get can hand it back.</p><p>There is a second reason. Get and delete often have no body. You still have to prove who you are. A token inside JSON is not there. The authorization header is.</p><p>One limit. A body can be JSON. Ours is. The bearer rules also allow a form body to carry a token, and only as a fallback, when a client cannot set the authorization header. A form is a different body. It is not your blog JSON. The token still stays in the header.</p><p>The body is the blog. The token is about the request, so it stays in the authorization header.</p><p>The quiz is under this tip, and the practice is right beside it. Work both before you leave.</p><p>I will meet you in the next tip.</p>

A 90-second tip: keep the bearer token in the Authorization header, not in the blog JSON, including when GET and DELETE have no body.

Token in the header | Tech Tips by Moh

A form body, when the client cannot set the Authorization header

Token in the header

<div class="course-slide cs-center">
  <p class="cs-kicker">This tip</p>
  <h2 class="cs-title cs-at-1">Where the token belongs</h2>
  <p class="cs-pill cs-at-9">Why not in the body?</p>
</div>

<div class="course-slide cs-center">
  <p class="cs-kicker">Create</p>
  <h2 class="cs-title">The body is the blog</h2>
  <p class="cs-pill cs-at-3-8"><span class="cs-mono">POST /api/blogs</span></p>
  <p class="cs-pill cs-at-9-3"><span class="cs-mono">JSON</span></p>
</div>

<div class="course-slide cs-center">
  <p class="cs-kicker">Who is asking</p>
  <h2 class="cs-title cs-at-2">Not part of the blog</h2>
  <p class="cs-pill cs-at-7-3"><span class="cs-mono">Authorization: Bearer</span></p>
</div>

<div class="course-slide cs-center">
  <p class="cs-kicker">Junior mistake</p>
  <h2 class="cs-title cs-at-2">Saved on the post</h2>
  <p class="cs-pill cs-at-8">The next GET hands it back</p>
</div>

<div class="course-slide cs-center">
  <p class="cs-kicker">Get and delete</p>
  <h2 class="cs-title cs-at-3-3">Often no body</h2>
  <p class="cs-pill cs-at-9">The header still carries it</p>
</div>

<div class="course-slide cs-center">
  <p class="cs-kicker">One limit</p>
  <h2 class="cs-title cs-at-2">A body can be JSON</h2>
  <p class="cs-pill cs-at-6">A form is the fallback</p>
</div>

<div class="course-slide cs-center">
  <p class="cs-kicker">Not the blog</p>
  <h2 class="cs-title cs-at-5">A form is a different body</h2>
  <p class="cs-pill cs-at-7-4">The token stays in the header</p>
</div>

<div class="course-slide cs-center">
  <p class="cs-kicker">Leave with this</p>
  <h2 class="cs-title">The body is the blog</h2>
  <p class="cs-pill cs-at-3-8">The token stays in the header</p>
  <p class="cs-pill cs-at-6">Quiz and practice</p>
</div>