How to Add an Authorization Bearer Token in Chrome

Updated October 2026 · v1.2.0

An API that expects an Authorization bearer token will reject a browser tab that does not send it. Curl and an API client already make this easy. The browser does not, unless the app itself attaches the header.

HeaderSwap can add that request header for a host you choose. Treat the token like a password. Free stores the profile on this device. Premium can auto-expire a temporary token and, only if you opt in, sync secret values.

Get HeaderSwap for Chrome

Send the token without an extension

Prefer this when you are calling the API a few times, not clicking through a web app.

Use curl or an API client. Pass the Authorization header there. You can see the exact request.
Do not paste the token into frontend source. A token in a git repo or a screenshot is leaked. Rotate it if that happened.
Stop using a token that has no expiry. Ask the API for a short-lived token when you are only debugging.

Attach the header in the browser

Use this when the web app you are clicking must call the API as a signed-in client.

Create a profile and limit the host. Apply the rule only to the API host, not to every site.
Add Authorization. Name: Authorization. Value: Bearer, then a space, then the token. The bearer preset starts that header for you.
Turn on auto-expiry for a temporary token. Premium can drop the header after 1 hour, 24 hours, or 7 days so a debug token does not sit there forever.

Keep the secret local

Share links can hide tokens and cookies. Use that option if you share a profile.
Premium sync omits secret-like values unless you turn that on.
A bearer token in a header is still a credential. Pause the profile on a shared computer.

Frequently Asked Questions

Will this log me into the website?

It only adds the header to matching requests. If the app expects a cookie session instead, a bearer header will not create that session.

Is the token sent to Pick Ads?

Not for normal local use. Sync of secret header values is off unless you opt in. The privacy policy describes that switch.

What if I rotate the token?

Edit the header value, or let auto-expiry remove the old one and add the new token.