Building the Brex API
building.brex.com
Building the Brex API
1–10 of 29 posts
Re: Building the Brex API
#2I'm seeing a lot more APIs adding the "Bearer " prefix which I don't really understand. What's the point of it? This particular one doesn't even look like a "conventional" bearer token in the JWT sense.
Re: Building the Brex API
#3I'm seeing a lot more APIs adding the "Bearer " prefix which I don't really understand. What's the point of it? This particular one doesn't even look like a "conventional" bearer token in the JWT sense.
The “bearer” prefix indicates the token is a “bearer” type token, as defined in RFC6750. As opposed to, for example, a “mac” token type.
The bearer token can be a JWT, but can also be a different format of bearer token as long as it conforms to the requirements in the spec (ie, only certain characters are allowed).
A “bearer” token means whoever has the token has authorization to perform the action. (Section 1.2 of the RFC goes into more details.)
Re: Building the Brex API
#4I'm seeing a lot more APIs adding the "Bearer " prefix which I don't really understand. What's the point of it? This particular one doesn't even look like a "conventional" bearer token in the JWT sense.
It's part of the HTTP standard for `Authorization` header, and there is the possibility of some HTTP client / server breaking if you don't add it.
Re: Building the Brex API
#5I'm seeing a lot more APIs adding the "Bearer " prefix which I don't really understand. What's the point of it? This particular one doesn't even look like a "conventional" bearer token in the JWT sense.
The “bearer” prefix indicates the token is a “bearer” type token, as defined in RFC6750. As opposed to, for example, a “mac” token type. The bearer token can be a JWT, but can also be a different format of bearer token as long as it conforms to the requirements in the spec (ie, only certain characters are allowed). A “bearer” token means whoever has the token has authorization to perform the action. (Section 1.2 of t…
Isn't that just fancy phrasing for a username/password?
Most APIs just have you set a key in the "Authorization" header. I don't get what value the "Bearer " prefix adds.
That RFC is strange and seems it can be summarized in one line:
Include header "Authorization: Bearer [API key]" for authenticating API calls.
Re: Building the Brex API
#6Earlier quoted context omitted.
The “bearer” prefix indicates the token is a “bearer” type token, as defined in RFC6750. As opposed to, for example, a “mac” token type. The bearer token can be a JWT, but can also be a different format of bearer token as long as it conforms to the requirements in the spec (ie, only certain characters are allowed). A “bearer” token means whoever has the token has authorization to perform the action. (Section 1.2 of t…
Isn't that just fancy phrasing for a username/password? Most APIs just have you set a key in the "Authorization" header. I don't get what value the "Bearer " prefix adds. That RFC is strange and seems it can be summarized in one line: Include header "Authorization: Bearer [API key]" for authenticating API calls.
The specified (rfc7235) syntax of the Authorization header is that it starts with an authentication scheme, followed by the parameters for that scheme. "Bearer" is one of those schemes. "Basic" and "Digest" are others.
Re: Building the Brex API
#7I'm seeing a lot more APIs adding the "Bearer " prefix which I don't really understand. What's the point of it? This particular one doesn't even look like a "conventional" bearer token in the JWT sense.
Bearer tokens precede JWT and it's part of the Authorization header.
For authentication & authorization, the caller sends a bearer token. The format of the token is known to both parties and the server knows how to validate it.
It's better than username password combos because (1) not every "account" has a password, (2) tokens can and generally do expire, (3) it's not tied to the password if the password changes the tokens continue to be valid, (4) the user can invalidate the tokens of their choice, (5) you can grant restricted permissions to a token. You can do more or less things with tokens based on the needs of the application but it decoupling it from password gives you additional security and flexibility.
Re: Building the Brex API
#8I'm seeing a lot more APIs adding the "Bearer " prefix which I don't really understand. What's the point of it? This particular one doesn't even look like a "conventional" bearer token in the JWT sense.
It's part of the HTTP standard for `Authorization` header, and there is the possibility of some HTTP client / server breaking if you don't add it.
Is there? If it's a custom token type, the serverside will never break with it. The client generally wants the caller to provide the "Bearer" string as well; can it break without it?
Re: Building the Brex API
#9How does Brex compare to Mercury?
Re: Building the Brex API
#10How does Brex compare to Mercury?
They're both good and much better than old-school banks like SVB / FRB etc. Brex also offers charge cards which Mercury doesn't (not sure if they have debit cards) so Brex has a broader set of things to offer.
Satchel a SaaS buying-guide (kinda like Wirecutter for startups) wrote an in-depth guide here https://satchel.com/store-of-money/#recommendations and recommends Brex Cash.