title: Why Doesn't my Authorization Header need "Bearer"?
body: <p>I am currently working with a group of applications that are running on two separate, but equivalent, environments (Referred to as <code>ENV1</code> and <code>ENV2</code>). I have been using OAuth 2.0 for Authorization and when I receive a response after requesting an access token from the OAuth service (I am making my requests through Postman) I get a response that looks like this from <code>ENV1</code> <em>and</em> <code>ENV2</code>:</p>
  <p><a href="https://i.stack.imgur.com/CPBuo.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/CPBuo.png" alt="OAuth Token Response for ENV1 &amp; ENV2" /></a></p>
  <p>As far as I am aware, I believe that this <code>&quot;token_type&quot;: &quot;Bearer&quot;</code> means that when I send in the <code>access_token</code> to my application I need to do so like this:</p>
  <p><a href="https://i.stack.imgur.com/u6OBW.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/u6OBW.png" alt="Application Request ENV1" /></a></p>
  <p>By sending in the token through the <code>Authorization</code> header, prefixed with &quot;Bearer&quot;. This approach works fine on <code>ENV1</code> but on <code>ENV2</code> the request fails <em>unless</em> I send in the token <em>alone</em> with no &quot;Bearer&quot; prefix:</p>
  <p><a href="https://i.stack.imgur.com/nXsvB.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/nXsvB.png" alt="Application Request ENV2" /></a></p>
  <p>If I send in the <code>Authorization</code> header with the &quot;Bearer&quot; prefix, I get a <code>401 Unauthorized</code> error as the response. This is the help tip that Postman provides(Emphasis mine):</p>
  <blockquote>
  <p>Similar to 403 Forbidden, but specifically for use when authentication is possible but has failed or not yet been provided. The response <strong>must include a WWW-Authenticate header field</strong> containing a challenge applicable to the requested resource.</p>
  </blockquote>
  <p>The problem here is that there <em><strong>IS</strong></em> a <code>WWW-Authenticate</code> header field, and it contains &quot;Bearer&quot;, which I would assume is a &quot;challenge applicable to the requested resource&quot; seeing as the token response contained <code>&quot;token_type&quot;: &quot;Bearer&quot;</code>:</p>
  <p><a href="https://i.stack.imgur.com/dQk5A.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/dQk5A.png" alt="WWW-Authenticate Response Header" /></a></p>
  <hr />
  <h2>Questions:</h2>
  <ul>
  <li><em>Why would this be different between environments?</em></li>
  <li><em>How is this even possible?</em> The documentation I have found on OAuth 2.0 shows that the &quot;Bearer&quot; prefix is needed for requests like the ones I am trying to make. (for example, in section 2.1 of the documentation <a href="https://datatracker.ietf.org/doc/html/rfc6750#section-2.1" rel="nofollow noreferrer">here</a>)</li>
  </ul>