# How use authorization mechanism in worker

**URL:** <https://community.temporal.io/t/how-use-authorization-mechanism-in-worker/3613>\
**Category:** Community Support\
**Tags:** go-sdk\
**Created:** [December 16, 2021, 11:23am UTC](https://community.temporal.io/t/how-use-authorization-mechanism-in-worker/3613 "2021-12-16T11:23:45Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![marimp8888](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/marimp8888/32/956_2.png) [@marimp8888](https://community.temporal.io/u/marimp8888)\
**Post date:** [December 16, 2021, 11:23am UTC](https://community.temporal.io/t/how-use-authorization-mechanism-in-worker/3613/1 "2021-12-16T11:23:45Z")

</div>

Hi all,  
I successfully implemented the authorization mechanism to authorize tctl cli with temporal server. I used authorizer/claimMapper in server and “temporal-tctl-authorization-plugin” plugin in tctl (the tctl pass a JWT token that contains the identity).  
I’m trying to understand if it is possible to use the same logic for “workers”. At the moment the workers are blocked because they are not authorized (how can I pass the JWT from worker and identify them).

Great Thanks  
Regards  
Marco

---

<div class="post-metadata">

**Author:** ![Chad\_Retz](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/chad_retz/32/1396_2.png) [@Chad\_Retz](https://community.temporal.io/u/Chad_Retz)\
**Post date:** [December 16, 2021, 2:37pm UTC](https://community.temporal.io/t/how-use-authorization-mechanism-in-worker/3613/2 "2021-12-16T14:37:35Z")

</div>

Absolutely. JWT-based authentication is usually via the `Authorization: Bearer <mytoken>` header which can be sent to the server via a `client.Options.HeadersProvider`. I opened [Add sample for auth token · Issue #160 · temporalio/samples-go · GitHub](https://github.com/temporalio/samples-go/issues/160) a couple of days ago to address this gap in the samples. The `tctl` CLI uses this same approach with your plugin since the `tctl` CLI just uses the SDK client.