# HttpBearerAuth

> HttpBearerAuth is an action filter that supports the authentication method based on HTTP Bearer token.

[API reference](/docs/api/index.md) › [yii](/docs/api/yii/index.md) › [filters](/docs/api/yii/filters/index.md) › [auth](/docs/api/yii/filters/auth/index.md) › HttpBearerAuth

| class | `yii\filters\auth\HttpBearerAuth` |
| --- | --- |
| Extends | [`HttpHeaderAuth`](/docs/api/yii/filters/auth/httpheaderauth/index.md) » [`AuthMethod`](/docs/api/yii/filters/auth/authmethod/index.md) » [`yii\base\ActionFilter`](/docs/api/yii/base/actionfilter/index.md) » [`yii\base\Behavior`](/docs/api/yii/base/behavior/index.md) » [`yii\base\BaseObject`](/docs/api/yii/base/baseobject/index.md) |
| Implements | [`AuthInterface`](/docs/api/yii/filters/auth/authinterface/index.md), [`yii\base\Configurable`](/docs/api/yii/base/configurable/index.md) |
| Since | 2.0 |
| Source | [`framework/filters/auth/HttpBearerAuth.php`](https://github.com/yiisoft/yii2/blob/22.0/framework/filters/auth/HttpBearerAuth.php#L35) |

HttpBearerAuth is an action filter that supports the authentication method based on HTTP Bearer token.

You may use HttpBearerAuth by attaching it as a behavior to a controller or module, like the following:

```
public function behaviors()
{
    return [
        'bearerAuth' => [
            'class' => \yii\filters\auth\HttpBearerAuth::class,
        ],
    ];
}
```

## Properties

| Property | Type | Description | Defined by |
| --- | --- | --- | --- |
| <span id="property-except"></span>[`$except`](/docs/api/yii/base/actionfilter/index.md#property-except) | `array` | List of action IDs that this filter should not apply to. Default: `[]`. | [`yii\base\ActionFilter`](/docs/api/yii/base/actionfilter/index.md) |
| <span id="property-header"></span>`$header` | `string` | Default: `'Authorization'`. | `HttpBearerAuth` |
| <span id="property-only"></span>[`$only`](/docs/api/yii/base/actionfilter/index.md#property-only) | `array` | List of action IDs that this filter should apply to. Default: `[]`. | [`yii\base\ActionFilter`](/docs/api/yii/base/actionfilter/index.md) |
| <span id="property-optional"></span>[`$optional`](/docs/api/yii/filters/auth/authmethod/index.md#property-optional) | `array` | List of action IDs that this filter will be applied to, but auth failure will not lead to error. Default: `[]`. Available since 2.0.7. | [`AuthMethod`](/docs/api/yii/filters/auth/authmethod/index.md) |
| <span id="property-owner"></span>[`$owner`](/docs/api/yii/base/behavior/index.md#property-owner) | `yii\base\T\|null` | The owner of this behavior Default: `null`. | [`yii\base\Behavior`](/docs/api/yii/base/behavior/index.md) |
| <span id="property-pattern"></span>`$pattern` | `string` | Default: `'/^Bearer\s+(.*?)$/'`. | `HttpBearerAuth` |
| <span id="property-realm"></span>`$realm` | `string` | The HTTP authentication realm Default: `'api'`. | `HttpBearerAuth` |
| <span id="property-request"></span>[`$request`](/docs/api/yii/filters/auth/authmethod/index.md#property-request) | [`yii\web\Request`](/docs/api/yii/web/request/index.md)`\|null` | The current request. Default: `null`. | [`AuthMethod`](/docs/api/yii/filters/auth/authmethod/index.md) |
| <span id="property-response"></span>[`$response`](/docs/api/yii/filters/auth/authmethod/index.md#property-response) | [`yii\web\Response`](/docs/api/yii/web/response/index.md)`\|null` | The response to be sent. Default: `null`. | [`AuthMethod`](/docs/api/yii/filters/auth/authmethod/index.md) |
| <span id="property-user"></span>[`$user`](/docs/api/yii/filters/auth/authmethod/index.md#property-user) | [`yii\web\User`](/docs/api/yii/web/user/index.md)`\|null` | The user object representing the user authentication status. Default: `null`. | [`AuthMethod`](/docs/api/yii/filters/auth/authmethod/index.md) |

## Methods

| Method | Description | Defined by |
| --- | --- | --- |
| <span id="method-__construct"></span>[`__construct()`](/docs/api/yii/base/baseobject/index.md#method-__construct) | Constructor. | [`yii\base\BaseObject`](/docs/api/yii/base/baseobject/index.md) |
| <span id="method-__call"></span>[`__call()`](/docs/api/yii/base/baseobject/index.md#method-__call) | Calls the named method which is not a class method. | [`yii\base\BaseObject`](/docs/api/yii/base/baseobject/index.md) |
| <span id="method-__get"></span>[`__get()`](/docs/api/yii/base/baseobject/index.md#method-__get) | Returns the value of an object property. | [`yii\base\BaseObject`](/docs/api/yii/base/baseobject/index.md) |
| <span id="method-__isset"></span>[`__isset()`](/docs/api/yii/base/baseobject/index.md#method-__isset) | Checks if a property is set, i.e. defined and not null. | [`yii\base\BaseObject`](/docs/api/yii/base/baseobject/index.md) |
| <span id="method-__set"></span>[`__set()`](/docs/api/yii/base/baseobject/index.md#method-__set) | Sets value of an object property. | [`yii\base\BaseObject`](/docs/api/yii/base/baseobject/index.md) |
| <span id="method-__unset"></span>[`__unset()`](/docs/api/yii/base/baseobject/index.md#method-__unset) | Sets an object property to null. | [`yii\base\BaseObject`](/docs/api/yii/base/baseobject/index.md) |
| <span id="method-afterAction"></span>[`afterAction()`](/docs/api/yii/base/actionfilter/index.md#method-afterAction) | This method is invoked right after an action is executed. | [`yii\base\ActionFilter`](/docs/api/yii/base/actionfilter/index.md) |
| <span id="method-afterFilter"></span>[`afterFilter()`](/docs/api/yii/base/actionfilter/index.md#method-afterFilter) |  | [`yii\base\ActionFilter`](/docs/api/yii/base/actionfilter/index.md) |
| <span id="method-attach"></span>[`attach()`](/docs/api/yii/base/actionfilter/index.md#method-attach) | Attaches the behavior object to the component. | [`yii\base\ActionFilter`](/docs/api/yii/base/actionfilter/index.md) |
| <span id="method-authenticate"></span>[`authenticate()`](/docs/api/yii/filters/auth/httpheaderauth/index.md#method-authenticate) | Authenticates the current user. | [`HttpHeaderAuth`](/docs/api/yii/filters/auth/httpheaderauth/index.md) |
| <span id="method-beforeAction"></span>[`beforeAction()`](/docs/api/yii/filters/auth/authmethod/index.md#method-beforeAction) | This method is invoked right before an action is to be executed (after all possible filters.) You may override this method to do last-minute preparation for the action. | [`AuthMethod`](/docs/api/yii/filters/auth/authmethod/index.md) |
| <span id="method-beforeFilter"></span>[`beforeFilter()`](/docs/api/yii/base/actionfilter/index.md#method-beforeFilter) |  | [`yii\base\ActionFilter`](/docs/api/yii/base/actionfilter/index.md) |
| <span id="method-canGetProperty"></span>[`canGetProperty()`](/docs/api/yii/base/baseobject/index.md#method-canGetProperty) | Returns a value indicating whether a property can be read. | [`yii\base\BaseObject`](/docs/api/yii/base/baseobject/index.md) |
| <span id="method-canSetProperty"></span>[`canSetProperty()`](/docs/api/yii/base/baseobject/index.md#method-canSetProperty) | Returns a value indicating whether a property can be set. | [`yii\base\BaseObject`](/docs/api/yii/base/baseobject/index.md) |
| [`challenge()`](#method-challenge) | Generates challenges upon authentication failure. | `HttpBearerAuth` |
| <span id="method-className"></span>[`className()`](/docs/api/yii/base/baseobject/index.md#method-className) static | Returns the fully qualified name of this class. | [`yii\base\BaseObject`](/docs/api/yii/base/baseobject/index.md) |
| <span id="method-detach"></span>[`detach()`](/docs/api/yii/base/actionfilter/index.md#method-detach) | Detaches the behavior object from the component. | [`yii\base\ActionFilter`](/docs/api/yii/base/actionfilter/index.md) |
| <span id="method-events"></span>[`events()`](/docs/api/yii/base/behavior/index.md#method-events) | Declares event handlers for the [`$owner`](/docs/api/yii/base/behavior/index.md#property-owner)'s events. | [`yii\base\Behavior`](/docs/api/yii/base/behavior/index.md) |
| <span id="method-handleFailure"></span>[`handleFailure()`](/docs/api/yii/filters/auth/authmethod/index.md#method-handleFailure) | Handles authentication failure. | [`AuthMethod`](/docs/api/yii/filters/auth/authmethod/index.md) |
| <span id="method-hasMethod"></span>[`hasMethod()`](/docs/api/yii/base/baseobject/index.md#method-hasMethod) | Returns a value indicating whether a method is defined. | [`yii\base\BaseObject`](/docs/api/yii/base/baseobject/index.md) |
| <span id="method-hasProperty"></span>[`hasProperty()`](/docs/api/yii/base/baseobject/index.md#method-hasProperty) | Returns a value indicating whether a property is defined. | [`yii\base\BaseObject`](/docs/api/yii/base/baseobject/index.md) |
| <span id="method-init"></span>[`init()`](/docs/api/yii/base/baseobject/index.md#method-init) | Initializes the object. | [`yii\base\BaseObject`](/docs/api/yii/base/baseobject/index.md) |
| <span id="method-getActionId"></span>[`getActionId()`](/docs/api/yii/base/actionfilter/index.md#method-getActionId) protected | Returns an action ID by converting [`Action::$uniqueId`](/docs/api/yii/base/action/index.md#property-uniqueId) into an ID relative to the module. | [`yii\base\ActionFilter`](/docs/api/yii/base/actionfilter/index.md) |
| <span id="method-isActive"></span>[`isActive()`](/docs/api/yii/base/actionfilter/index.md#method-isActive) protected | Returns a value indicating whether the filter is active for the given action. | [`yii\base\ActionFilter`](/docs/api/yii/base/actionfilter/index.md) |
| <span id="method-isOptional"></span>[`isOptional()`](/docs/api/yii/filters/auth/authmethod/index.md#method-isOptional) protected | Checks, whether authentication is optional for the given action. | [`AuthMethod`](/docs/api/yii/filters/auth/authmethod/index.md) |

## Method details

### challenge() <span id="method-challenge"></span>

```php
public function challenge(mixed $response): mixed
```

Generates challenges upon authentication failure.

For example, some appropriate HTTP headers may be generated.

**Parameters**

| Parameter | Type | Description |
| --- | --- | --- |
| `$response` | `mixed` |  |

**Returns**

`mixed`