The value MUST be Bearer or another token_type value that the Client has negotiated with the Authorization Server.