title: How to properly call a protected API route with a token
body: <p>I have this route in my API app:</p>
  
  <pre><code>router.get('/users', auth, function(req, res) {
    User.find({}, function(err, users) {
      res.json(users);
    });
  });
  </code></pre>
  
  <p>In postman I do the api call like this:</p>
  
  <blockquote>
    <p>URL + users?token=<em>token</em></p>
  </blockquote>
  
  <p>But this returns:</p>
  
  <blockquote>
    <h1>Format is Authorization: Bearer [token]</h1>
  </blockquote>
  
  <p>How can I properly do the api call with a token in postman?</p>