Authentication & Secrets
Bearer Token
Also: access token
A credential accepted from whoever presents it, usually in an Authorization header.
In more detail
No further proof is requested, so anyone who copies the token can use it until it expires or is revoked. API keys and many OAuth access tokens behave this way. Keep them out of logs, URLs and chat, and keep their scope and lifetime small.