Skip to content


Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?


Failed to load latest commit information.
Latest commit message
Commit time
October 21, 2022 13:38
November 28, 2022 10:15
December 7, 2022 21:11
March 16, 2019 10:55
October 8, 2018 14:15
February 9, 2013 15:55
December 7, 2022 13:19
November 14, 2021 06:52


HTTP Bearer authentication strategy for Passport.

This module lets you authenticate HTTP requests using bearer tokens, as specified by RFC 6750, in your Node.js applications. By plugging into Passport, bearer token support can be easily and unobtrusively integrated into any application or framework that supports Connect-style middleware, including Express.

🛠️ API Reference❤️ Sponsors

Node.js, Express, MongoDB & More: The Complete Bootcamp 2020
Master Node by building a real-world RESTful API and web app (with authentication, Node.js security, payments & more)

npm build coverage ...


$ npm install passport-http-bearer

TypeScript support

$ npm install @types/passport-http-bearer


Configure Strategy

The HTTP Bearer authentication strategy authenticates users using a bearer token. The strategy requires a verify callback, which accepts that credential and calls done providing a user. Optional info can be passed, typically including associated scope, which will be set by Passport at req.authInfo to be used by later middleware for authorization and access control.

passport.use(new BearerStrategy(
  function(token, done) {
    User.findOne({ token: token }, function (err, user) {
      if (err) { return done(err); }
      if (!user) { return done(null, false); }
      return done(null, user, { scope: 'all' });

Authenticate Requests

Use passport.authenticate(), specifying the 'bearer' strategy, to authenticate requests. Requests containing bearer tokens do not require session support, so the session option can be set to false.

For example, as route middleware in an Express application:

  passport.authenticate('bearer', { session: false }),
  function(req, res) {

Issuing Tokens

Bearer tokens are typically issued using OAuth 2.0. OAuth2orize is a toolkit for implementing OAuth 2.0 servers and issuing bearer tokens. Once issued, this module can be used to authenticate tokens as described above.

Making authenticated requests

The HTTP Bearer authentication strategy authenticates requests based on a bearer token contained in the:

  • Authorization header field where the value is in the format {scheme} {token} and scheme is "Bearer" in this case.
  • or access_token body parameter
  • or access_token query parameter


For a complete, working example, refer to the Bearer example.

Related Modules

  • OAuth2orize — OAuth 2.0 authorization server toolkit


The MIT License

Copyright (c) 2011-2013 Jared Hanson <>