The credential of an HTTP Authorization Bearer header, over the RFC 6750 token alphabet. The span covers the Bearer keyword as well as the value: a bare token has no shape of its own, so the keyword is what makes the match honest, and a value cut from its keyword would not survive on its own. Deliberately catch-all, it takes whatever follows the keyword, opaque session tokens, JWTs and OAuth access tokens alike, and the sixteen character minimum keeps placeholders such as Bearer TOKEN out. Basic and X-Api-Key headers are not covered. Collision: whenever the value is a JWT this fires on the same span as jwt, which carries the more informative label, and a digit-heavy token also trips de-phone on a sub-span.
Label: BEARER_TOKEN
\b(?i:bearer) [A-Za-z0-9._~+/-]{15,}[A-Za-z0-9_~+/]={0,2}Authorization: Bearer aBcDeF0123456789GhIjKl → Bearer aBcDeF0123456789GhIjKlcurl -H 'authorization: bearer 0123456789abcdef0123' → bearer 0123456789abcdef0123Bearer shortBearer <redacted>Tags: international, secrets, software-dev