An API authenticates only with Authorization: Bearer… (Auth & security interview question)

Effectively none, because the browser never sends the token automatically; the trade-off is that the token is readable by XSS

Its CSRF exposure is effectively none. CSRF depends on credentials the browser sends on its own, like cookies. An attacker's page doesn't have the bearer token, and it can't make the browser attach it. So "the browser attaches the bearer token to every cross-site request" is wrong, and synchronizer tokens aren't needed.

The cost: any script running in your page can read the token. So "XSS stops being a concern too" is wrong. XSS becomes the main risk to manage.

CSRF Prevention Cheat Sheet (OWASP) (https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)cheatsheetseries.owasp.org