Using a bearer token for authentication(≠ authorization) : <p>A request using the <code>Authorization: bearer [token]</code> can be used for authentication?</p>

<p>or </p>

<p>Should we use another method to authenticate a client and issue a token then use the token as a bearer token like OAuth2 does?
Why popular web services(e.g. Github, AWS, Google..) uses other method(like AWS does: <code>Authorization: AWS4-HMAC-SHA256 
Credential=...</code>) to authenticate a client. The point of the question is: is there any valunerables or violation of standards in the following flow or not.</p>

<p>I would like to use the following flow:</p>

<p><code>the client</code>: which is like Twitter client.<br>
<code>the server</code>: which is like Twitter API.</p>

<ol>
<li>the client makes the token(encrypted user ID, password, and etc).</li>
<li>the client requests a resource to the server with <code>Authorization: bearer [token]</code>.</li>
<li>the server decrypts the token and authenticates the client.</li>
<li>the server response the resource.</li>
</ol>

<p>I read the following RFC but I haven't found any reason why I shouldn't or should use the flow above.</p>

<p><a href="https://tools.ietf.org/html/rfc7235" rel="noreferrer">https://tools.ietf.org/html/rfc7235</a><br>
<a href="https://tools.ietf.org/html/rfc6750" rel="noreferrer">https://tools.ietf.org/html/rfc6750</a></p>

<p>Thanks</p>
