title: OAuth2 Bearer token used like API_KEY
body: <p>We want to make simple authorization for server-server HTTPS communication (we control both servers) like classic API_KEY: client has hardcoded (in a config) a key which use in every request. Server check if the key is valid.</p>
  
  <p>Our colleague has implemented it like OAuth2 Bearer token (<a href="https://www.ietf.org/rfc/rfc6750.txt" rel="nofollow noreferrer">RFC6750</a>)</p>
  
  <p><code>
  Authorization: Bearer client_key
  </code></p>
  
  <p>So the client has the <code>client_key</code> in the config, it's never refreshed. It works well, we have just a philosophical dispute in the company, if such "hardcoded" Bearer token is along with OAuth2 or not. (<em>Disclaimer</em>: I am not with any side of the dispute.)</p>