> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/honojs/hono/llms.txt
> Use this file to discover all available pages before exploring further.

# bearerAuth

> API reference for the Bearer Auth middleware

## Import

```typescript theme={null}
import { bearerAuth } from 'hono/bearer-auth'
```

## Usage

```typescript theme={null}
const app = new Hono()

const token = 'honoishot'

app.use('/api/*', bearerAuth({ token }))

app.get('/api/page', (c) => {
  return c.json({ message: 'You are authorized' })
})
```

## Options

The `bearerAuth` middleware accepts a `BearerAuthOptions` object:

<ParamField path="token" type="string | string[]">
  The token or array of tokens to validate against. Required if `verifyToken` is not provided.
</ParamField>

<ParamField path="verifyToken" type="(token: string, c: Context) => boolean | Promise<boolean>">
  Custom function to verify the token. Alternative to providing static `token` values.
</ParamField>

<ParamField path="realm" type="string" default="">
  The domain name of the realm, as part of the returned WWW-Authenticate challenge header.
</ParamField>

<ParamField path="prefix" type="string" default="Bearer">
  The prefix (or schema) for the Authorization header value. If set to empty string, no prefix is expected.
</ParamField>

<ParamField path="headerName" type="string" default="Authorization">
  The header name to look for the token.
</ParamField>

<ParamField path="hashFunction" type="Function">
  A function to handle hashing for safe comparison of authentication tokens.
</ParamField>

<ParamField path="noAuthenticationHeader.message" type="string | object | MessageFunction" default="Unauthorized">
  The message returned when no authentication header is provided.
</ParamField>

<ParamField path="noAuthenticationHeader.wwwAuthenticateHeader" type="string | object | MessageFunction" default="Bearer realm=&#x22;&#x22;">
  The WWW-Authenticate header value when no authentication header is provided.
</ParamField>

<ParamField path="invalidAuthenticationHeader.message" type="string | object | MessageFunction" default="Bad Request">
  The message returned when authentication header format is invalid.
</ParamField>

<ParamField path="invalidAuthenticationHeader.wwwAuthenticateHeader" type="string | object | MessageFunction" default="Bearer error=&#x22;invalid_request&#x22;">
  The WWW-Authenticate header value when authentication header is invalid.
</ParamField>

<ParamField path="invalidToken.message" type="string | object | MessageFunction" default="Unauthorized">
  The message returned when token is invalid.
</ParamField>

<ParamField path="invalidToken.wwwAuthenticateHeader" type="string | object | MessageFunction" default="Bearer error=&#x22;invalid_token&#x22;">
  The WWW-Authenticate header value when token is invalid.
</ParamField>

## Signature

```typescript theme={null}
bearerAuth(options: BearerAuthOptions): MiddlewareHandler
```

## Examples

### Multiple tokens

```typescript theme={null}
app.use('/api/*', bearerAuth({ 
  token: ['token1', 'token2', 'token3'] 
}))
```

### Custom token verification

```typescript theme={null}
app.use('/api/*', bearerAuth({
  verifyToken: async (token, c) => {
    // Verify against database or external service
    const valid = await validateTokenInDatabase(token)
    return valid
  },
}))
```

### Custom prefix

```typescript theme={null}
// Use "Token" instead of "Bearer"
app.use('/api/*', bearerAuth({ 
  token: 'secret',
  prefix: 'Token'
}))

// Request header: Authorization: Token secret
```

### No prefix

```typescript theme={null}
app.use('/api/*', bearerAuth({ 
  token: 'secret',
  prefix: ''
}))

// Request header: Authorization: secret
```

### Custom error messages

```typescript theme={null}
app.use('/api/*', bearerAuth({
  token: 'secret',
  noAuthenticationHeader: {
    message: 'Please provide authentication',
    wwwAuthenticateHeader: 'Bearer realm="api"'
  },
  invalidToken: {
    message: { error: 'Invalid token provided' }
  }
}))
```

## Behavior

* Returns 401 Unauthorized if token is missing or invalid
* Returns 400 Bad Request if Authorization header format is invalid
* Sets WWW-Authenticate header with appropriate error information
* Uses timing-safe comparison to prevent timing attacks
* Supports custom hash functions for secure token comparison