Securityflags: i

Bearer Token (Authorization Header)

Match Bearer token values from HTTP Authorization headers, capturing the raw token string.

Available in

JavaScript / ECMAScript code

jsJavaScript

const re = new RegExp("Bearer\\s+([A-Za-z0-9\\-._~+\\/]+=*)", "i");
const input = "Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.abc.def";
const matches = [...input.matchAll(re)];
console.log(matches.map(m => m[0]));

Uses `String.prototype.matchAll` for global iteration (Node 12+ / all modern browsers).

Python (re) code

pyPython

import re

pattern = re.compile(r"Bearer\s+([A-Za-z0-9\-._~+\/]+=*)", re.IGNORECASE)
input_text = "Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.abc.def"
for m in pattern.finditer(input_text):
    print(m.group(0))

Stdlib `re` module — no third-party dependency. Works on Python 3.6+.

Go (RE2) code

goGo

package main

import (
	"fmt"
	"regexp"
)

func main() {
	re := regexp.MustCompile(`(?i)Bearer\s+([A-Za-z0-9\-._~+\/]+=*)`)
	input := `Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.abc.def`
	for _, match := range re.FindAllString(input, -1) {
		fmt.Println(match)
	}
}

Uses `regexp.MustCompile` (panics on bad patterns at startup) and `FindAllString` for all matches.

Pattern

regexengine-agnostic

Bearer\s+([A-Za-z0-9\-._~+\/]+=*)   (flags: i)

Raw source: Bearer\s+([A-Za-z0-9\-._~+\/]+=*)

How it works

Bearer\s+ matches the scheme keyword (case-insensitive via i flag) and required whitespace. ([A-Za-z0-9\-._~+\/]+=*) captures the token value using the set of characters allowed in OAuth 2.0 Bearer tokens, with optional trailing = padding.