What are two methods for sending bearer access tokens in resource requests to servers? (Choose two)

Sending tokens in plaintext without a defined transport mechanism is not a valid bearer token transmission method and would be a security violation, as RFC 6750 requires TLS protection.

There is no specification called 'HTTP API schema' as a bearer token transmission method; this is not defined in RFC 6750 or any related OAuth 2.0 standard.

Sending the bearer token in the HTTP request entity-body is a valid method defined in RFC 6750 Section 2.2, where the token is included as the 'access_token' parameter in a form-encoded request body with Content-Type 'application/x-www-form-urlencoded'.

Including the bearer token in the 'Authorization' request header field using the format 'Authorization: Bearer <token>' is the most widely used method, defined in RFC 6750 Section 2.1, and is preferred because it keeps the token out of server logs.

While RFC 6750 Section 2.3 does mention the URI query parameter method, it is explicitly described as a last resort due to security risks from tokens appearing in server logs and browser history.