# HTTP and Bearer Tokens: A Primer for Python Devs (2026)

> An HTTP and bearer token primer for Python devs: methods, status codes, JSON bodies, and how an Authorization Bearer header authenticates an API call.

*Source: https://www.infowok.com/http-bearer-tokens-python-primer/ · Sukhveer Kaur · Published June 22, 2026*

---

The moment an agent tutorial leaves your laptop, the vocabulary shifts: POST this endpoint, send an `Authorization: Bearer` header, watch for a 401. If HTTP was always something other people's code handled, that's where deploy and MCP guides start to blur. This **bearer token** and HTTP primer covers just enough of the web's plumbing to make those parts legible.

You don't need to become a networking expert. You need a handful of ideas — methods, status codes, JSON bodies, and how a token rides along to prove who you are. Get those, and the [MCP server](/build-mcp-server-python-production/) and [deploy](/build-agentic-ai-app-python-part-2/) tutorials stop assuming knowledge you were never handed.

<Prerequisites>

- You can read a basic Python function and a dictionary — new to that? The [Python for AI agents primer](/ai-agents-from-scratch-python-part-0/) covers both
- That's it — no prior web or networking background needed

</Prerequisites>

<KeyTakeaways>

- **HTTP is request/response:** a client sends a method to a URL, the server replies with a status code and (usually) JSON.
- **The methods that matter** are GET (read), POST (send), PUT/PATCH (update), DELETE — plus 200/201/400/401/404/500 status codes.
- **A bearer token proves who you are:** send it as `Authorization: Bearer <token>` on every protected request.
- **Agents and MCP servers run on this** — a token on each call is how a server checks the caller before running a tool.

</KeyTakeaways>

## HTTP in one picture: request and response

**HTTP** is the protocol the web runs on, and the whole model is a conversation: a *client* sends a **request** to a URL, and a *server* sends back a **response**. Nothing is remembered between requests — each one stands alone, which is why APIs make you send your credentials every time ([MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Overview)).

A request carries four things worth knowing: a **method** (what you want to do), a **URL** (where), **headers** (metadata, including auth), and sometimes a **body** (data you're sending, usually JSON). The response carries a **status code** (how it went) and a body (what you got back). That's the entire shape — everything else is detail on top.

## The methods and status codes you'll actually read

You don't need all of HTTP, just the common verbs and replies. The **methods**:

- **GET** — read data ("give me this resource").
- **POST** — send data or create something ("here's a new chat message").
- **PUT / PATCH** — update an existing resource.
- **DELETE** — remove one.

And the **status codes**, grouped by their first digit: **2xx** worked (200 OK, 201 Created), **4xx** you messed up (400 bad request, 401 unauthorized, 404 not found), **5xx** the server messed up (500 server error). **Read the first digit and you instantly know who's at fault** — your request or their server. That single habit makes debugging an API call far faster.

<Callout type="note" title="JSON is the body format you'll see most">
API requests and responses almost always carry their data as JSON — the same key/value shape as a Python dictionary. Your HTTP client converts between JSON text and Python objects for you, so a POST body is usually just a dict you hand to the client.
</Callout>

## The bearer token: proving who you are

Most useful endpoints aren't open to the world — you have to prove you're allowed. The standard way is a **bearer token**: a secret string you put in the `Authorization` header on every request. The name is literal — *whoever bears the token* gets access — so it's a credential you guard like a password and only send over HTTPS ([RFC 6750](https://datatracker.ietf.org/doc/html/rfc6750)).

The header has one fixed shape:

```
Authorization: Bearer <your-token-here>
```

The literal word `Bearer`, a space, then the token. The server reads that header, validates the token, and either serves your request or replies **401 Unauthorized**. **A 401 almost always means a missing, malformed, or expired token** — check the header before anything else.

## Making an authenticated request in Python

Here's the whole thing in code, using [httpx](https://www.python-httpx.org/) (an async-friendly client agents favour). A POST, a JSON body, and a bearer token in the headers:

```python
import httpx

headers = {"Authorization": f"Bearer {token}"}      # the auth header
payload = {"message": "Hello", "session_id": "abc"} # the JSON body

resp = httpx.post("https://api.example.com/chat", json=payload, headers=headers)

if resp.status_code == 200:
    print(resp.json())          # parse the JSON response into a dict
elif resp.status_code == 401:
    print("Bad or missing token")
```

Read it against the four parts: method (`post`), URL, headers (with the bearer token), and a JSON body. The response gives you a status code to branch on and `.json()` to turn the reply into a dict. **That's the exact pattern an agent uses to call an MCP server or any authenticated tool** — there's nothing more to it.

<Callout type="warning" title="Tokens belong in headers, over HTTPS — never in the URL">
Don't put a token in the query string (`?token=...`); URLs get logged, cached, and shared, leaking the secret. Send it in the `Authorization` header, always over `https://`, and load it from an environment variable rather than hardcoding it — the same discipline as an [LLM API key](/llm-api-key-setup-primer/).
</Callout>

## Why agents and MCP servers lean on this

Pulling it together: once an agent talks to the outside world, every tool call is an HTTP request, and every protected tool needs a token. **A production MCP server validates a bearer token on each request before it runs a single tool** — that's what separates a deployed tool from a public API anyone can hit.

The [build-an-MCP-server guide](/build-mcp-server-python-production/) is built entirely on this idea, and the [MCP client](/build-agentic-ai-app-python-part-5/) is the other half: it attaches the token so the agent is allowed in. Read HTTP and bearer tokens fluently and both stop being walls.

## Quick recap

The whole primer, in five lines:

- **HTTP** is request → response: method, URL, headers, body in; status code and body back.
- **Know** GET/POST/PUT/DELETE and 200/201/400/401/404/500 (first digit = who's at fault).
- **A bearer token** proves identity, sent as `Authorization: Bearer <token>`.
- **In Python,** post a JSON body with the token in `headers` and branch on `status_code`.
- **Agents and MCP servers** validate that token on every protected request.

## Frequently Asked Questions

**What is a bearer token?** A secret string sent in the `Authorization` header to prove a client may call an API — whoever holds it gets access, so keep it secret and use HTTPS.

**What does the header look like?** `Authorization: Bearer <token>` — the word Bearer, a space, the token. A bad one returns 401.

**Which methods and codes matter?** GET/POST/PUT/PATCH/DELETE, and 200/201/400/401/404/500.

**Why do agents use bearer tokens?** Their tools are HTTP endpoints; a token per request lets the server authorise the caller before running a tool.

## Conclusion

HTTP is just request and response, and a bearer token is just a password that rides in a header to prove you're allowed in. Learn the handful of methods, read status codes by their first digit, and recognise `Authorization: Bearer` for what it is, and the deploy and MCP chapters of any agent series stop assuming a background you were never given. It's the web's plumbing, demystified to exactly the depth an agent developer needs.

**What tripped you up first — status codes, headers, or where the token goes?** Tell me in the comments.

<NextSteps>

- **Keep the token safe:** the [LLM API key primer](/llm-api-key-setup-primer/) covers the same env-var discipline.
- **Build the server side:** [build a production MCP server](/build-mcp-server-python-production/) validates bearer tokens on every call.
- **Build the client side:** the [MCP client tutorial](/build-agentic-ai-app-python-part-5/) attaches the token so the agent gets in.

</NextSteps>