Bearer Tokens & Headers
Require and read an access token per request.
Bearer Tokens & Headers is a free MCP Academy lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the MCP Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
What a Bearer Token Is
A bearer token is a secret string that means "whoever holds this is allowed in." The server trusts the holder, no password needed per call. 🎟️
The Authorization Header
Clients send the token in the HTTP Authorization header so it rides along with every request automatically.
The Bearer Prefix
The header value starts with the word Bearer, a space, then the token. That prefix tells the server which auth scheme is in use.
GET /mcp HTTP/1.1
Authorization: Bearer sk-7f3a9c2e8b1d4a6fReading the Header on the Server
Your MCP server pulls the Authorization value off the incoming request before handling the JSON-RPC body.
auth = request.headers.get("Authorization", "")
token = auth.removeprefix("Bearer ").strip()Compare, Then Decide
The server checks the token against what it expects. A match lets the request through; anything else is rejected.
if token != EXPECTED_TOKEN:
raise HTTPException(status_code=401)Use Constant-Time Comparison
Plain equality can leak timing hints. Use a constant-time compare so attackers cannot guess the token character by character.
import hmac
ok = hmac.compare_digest(token, EXPECTED_TOKEN)401 Means Not Authenticated
Return 401 Unauthorized when the token is missing or invalid. It signals the caller to supply valid credentials.
403 Means Not Allowed
Use 403 Forbidden when the caller is known but lacks permission for that action. It is a different answer than 401.
Keep Tokens Out of URLs
Never put the token in the query string. URLs land in logs and browser history, so the header is the safer home for secrets.
Store Secrets in the Environment
Read the expected token from an environment variable, never hardcoded in source. That keeps it out of your version control.
import os
EXPECTED_TOKEN = os.environ["MCP_TOKEN"]Rotate When in Doubt
If a token might be exposed, issue a new one and retire the old. Rotation limits how long a leaked secret stays useful.
Quick Check
Spot the correct header format.
Recap: One Header, One Check
Send the secret as Bearer in the Authorization header, compare it safely, and answer 401 when it fails. Simple and solid. ✅
Frequently asked questions
Is the “Bearer Tokens & Headers” lesson free?
Yes — the full text of “Bearer Tokens & Headers” is free to read here on the web, and the MCP Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the MCP Academy course, upgrade to CoddyKit PRO.
What will I learn in “Bearer Tokens & Headers”?
Require and read an access token per request. You practise MCP Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start MCP Academy?
No prior experience is required. MCP Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Bearer Tokens & Headers” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this MCP Academy lesson?
Yes. Every MCP Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Why Remote Servers Need Auth
- Bearer Tokens & Headers
- The OAuth Flow in MCP
- Scope What a Token Can Do