So, which HTTP header should we use? The common convention is to use the Authorization header, which has the following syntax:

Authorization: <type> <credentials>

The type is the authentication type, and the credentials are a representation of the user's credentials. There are many types of authentication schemes supported, such as Basic, Bearer, Digest, Negotiate, and OAuth, plus many more. The most common schemes are Basic and Bearer.

The Basic scheme sends the credentials as a username/password pair separated by a colon (for example, username:password), which are Base64-encoded. It is also the most primitive and insecure form of authentication scheme, as the usernames and passwords are transmitted as plaintext.

Instead, we will use the Bearer scheme, where the credential is the token itself:

Authorization: Bearer eyJhbGciOiJSUzUxMiIsInR5cCI6I...2ufQdDkg