---
slug: "BearerToken"
name: "BearerToken"
type: "Protocols"
layer: "Society"
ref: "BearerToken#190a"
sema_id: "sema:BearerToken#mh:SHA-256:190a706b87eb5e59dea9d23a06f8f13f45081dec847572be38dfb398cf201112"
tags: ["Society","Protocols"]
updated: 2026-11-11
mindscape: "bootstrap"
index_url: https://mindscape.pages.dev/bootstrap/index.json
url: https://mindscape.pages.dev/bootstrap/BearerToken/
related: ["Identity","ExpiringToken","TieredAccess"]
---

# BearerToken

Possession-based authorization independent of token representation

Layer: Society · Category: Protocols

## Mechanism

A portable authorization artifact whose presentation is sufficient to exercise a declared grant. The bearer need not prove an [Identity](https://mindscape.pages.dev/bootstrap/Identity.md) or possession of separate key material. A verifier resolves the token's validity and token-conferred authority through an authority-defined mechanism, such as local verification of a protected structured token or lookup or introspection of an opaque reference token. Representation, expiry, revocation, and transfer policy are supplied by descendants or the deployment.

## Invariants

- Possession Semantics: Presenting the same valid token confers the same token-scoped authority regardless of the bearer's [Identity](https://mindscape.pages.dev/bootstrap/Identity.md).
- Validation Boundary: Token-conferred authority is recognized only when the verifier's authority-defined validation mechanism accepts the token for the requested use.

## Postconditions

- Verifier produces an authorization decision from token acceptance and associated grant without separate bearer identity proof

## Failure modes

- Disclosure: A party that obtains an accepted token can exercise its token-conferred authority.

## Builds on

- [Identity](https://mindscape.pages.dev/bootstrap/Identity.md) (Infrastructure; References)

## Used by

- [ExpiringToken](https://mindscape.pages.dev/bootstrap/ExpiringToken.md) (Society; References)
- [TieredAccess](https://mindscape.pages.dev/bootstrap/TieredAccess.md) (Society; Composes with)

## Identity

- Sema ID: `sema:BearerToken#mh:SHA-256:190a706b87eb5e59dea9d23a06f8f13f45081dec847572be38dfb398cf201112`
- Ref: `BearerToken#190a`
- Supersedes:
  - `sema:BearerToken#mh:SHA-256:e5bda2f4295b37f411e5a32026a12b31d0f80308f19d077012cf519a16b11825`
  - `sema:BearerToken#mh:SHA-256:a682c6c4c3503f4180e0eed88045b7d58d15d4fc5e5dfe6456e65768bf4d0aad`

## Links

- [Pattern page](https://mindscape.pages.dev/bootstrap/BearerToken/)
- [View in the interactive graph](https://mindscape.pages.dev/bootstrap/#BearerToken)
- [JSON](https://mindscape.pages.dev/bootstrap/BearerToken.json)
- [Index of all patterns](https://mindscape.pages.dev/bootstrap/index.json)