What is the difference between Bearer Token & PAT Token?

Question

What is the difference between Bearer Token & PAT Token?

David Maryo 126

When we issue the below command, I see it is generating the Bearer Token.

az account get-access-token --resource https://graph.microsoft.com

And there is something called us Personal Access Token (PAT). I would like to understand the difference between these two tokens and also the maximum validity of both the token. Also when to choose which?

Accepted answer

0 additional answers

Your answer

Answer 1

Michael Taylor 60,341

You can google for the differences and when you want to choose one vs the other as it can be complex. But a high level summary.

PAT is a personal access token. Normally a user requests this and the system generates a complex string value. That string value is then used to identify the user in requests. Think of it like a key to a lock. PATs are generally limited to a fixed period of time such as 90 days.

Bearer tokens are for OAuth2 authentication. A bearer token is an encoded value that generally contains the user ID, authenticated token and a timetamp. It is most commonly used in REST APIs. If the API supports OAuth2 then it'll use a bearer token. The user (or client app) sends credentials to the server to authenticate. They get back a bearer token that is good for a fixed period of time (determined by the server). Subsequent calls to the API pass the bearer token for authentication.

Which do you use? Depends on the circumstance. If you are a user trying to authenticate against and API so you can script something then you'll use a PAT if the API supports it (aka Azure). If you are building an application to consume an API and the API supports OAuth2 then you'll need to get a client ID/secret from the API provider. Then you'll use OAuth2 to get the bearer token for your session and then use that until you're done. The next time you need to contact the API you'll request a new bearer token.

Both approaches have the same capabilities, it is just dependent upon what the API you're calling wants to use.

Ash 120 Reputation points Microsoft Employee

2023-02-06T11:13:33.06+00:00

In any circumstances would we need both?
Michael Taylor 60,341 Reputation points

2023-02-06T15:53:44.1666667+00:00

Depends on whether you're on the client or server side. On the server side there are definitely cases where you would want to support both. OAuth2 is for app to app so if your API needs to support being called, which most do, then OAuth makes sense. In general this requires setting up a client ID for the client much like a typical user account.

PATs are short term tokens created for a user. These are generated by a user when they want to make API calls directly such as for testing or using in an API client like Postman. PATs are preferred as they are short lived, controlled by the user and can be revoked.

If your API needs to support both scenarios then you would support both in your authentication layer. Azure DevOps for example supports both but most APIs outside MS do not currently support PATs that I'm aware of.

On the client side you don't need to support both. If you are building an app that needs to use an API then you're probably using OAuth2 client credentials. If your app needed to run in the context of a user then you'd still use OAuth2 but with grant flow (or whatever it is called these days) such that the user has to grant permissions for your app to access their data.

A case for supporting PAT on the client side would be if you're building a tool, such as a Powershell script, that needs to access a resource and you want the user to provide you the token to use. You could use OAuth but that requires a handshake to get the bearer token. With a PAT you'd just call the API directly with the PAT. This is easier lifetime management on the script side. But that also means each time you call the API then the server API has to validate the PAT is still valid so there is an insignificant perf hit. But that is the APIs problem.

Share via

What is the difference between Bearer Token & PAT Token?

0 additional answers

Your answer