API Keys and Bearer

Most APIs identify you with a header rather than a login form. The common shape is:

curl -s -H 'Authorization: Bearer YOUR_TOKEN' http://127.0.0.1:9132/me

Bearer means exactly what it sounds like: whoever bears this token is treated as you. There is no further check, no password, no second factor. A leaked token is a leaked account until it is revoked.

That has consequences for how you handle it. A token in a URL ends up in browser history and server logs, so it belongs in a header. A token in a shell command ends up in your shell history, which is why real scripts read it from an environment variable instead of hard-coding it.

Some APIs use a differently named header such as X-API-Key. The mechanics are identical: a secret string in a header, sent with every request.