RFC 6750 defines three transports: the Authorization header (preferred), a form-encoded body parameter and a URI query parameter, which RFC 9700 and the OAuth 2.1 draft forbid because URLs leak into logs, histories and Referer headers. Bearer tokens must only travel over TLS.
Anyone who steals a bearer token (from logs, browser storage, a compromised proxy) can use it until it expires, so keep lifetimes short and scopes narrow. Sender-constrained tokens close the gap: DPoP (RFC 9449) binds a token to a key the client proves with each request, and mTLS-bound tokens (RFC 8705) bind it to a client certificate; RFC 9700 recommends them.