---
title: "Authenticate with tokens in headers · Agent Wranglers"
url: https://agentwranglers.se/playbook/api-design/api-security/token-auth
updated: 2026-10-20
licence: "All rights reserved"
---

# Authenticate with tokens in headers

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [API security](https://agentwranglers.se/playbook/api-design/api-security)
- Rule: Authenticate API calls with short-lived tokens in the `Authorization` header, issued through OAuth 2 for anything acting for a user.
- How: Follow the OAuth security best practice in RFC 9700. Use the authorization code flow with PKCE for apps, and client credentials for servers. Let access tokens expire within an hour, and renew them with refresh tokens. Publish protected resource metadata as RFC 9728 describes. Check every token as in [token checks](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/token-checks). For calls from browsers on other sites, see [strict CORS](https://agentwranglers.se/playbook/adversarial-testing/requests-and-files/strict-cors).
- Check: A call without a token gets 401 with a `WWW-Authenticate` header. An expired token gets 401 too. A freshly issued access token expires at most one hour after it was issued.

Example:

```http
HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer resource_metadata="https://api.example.com/.well-known/oauth-protected-resource"
Content-Type: application/problem+json
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers api design playbook: https://agentwranglers.se/playbook/api-design/api-security/token-auth`.

- Next: [Grant narrow scopes](https://agentwranglers.se/playbook/api-design/api-security/token-scopes)
- [API security](https://agentwranglers.se/playbook/api-design/api-security)