diff --git a/sketching/curl.dms b/sketching/curl.dms
index 7e92147..2ff17b8 100644
--- a/sketching/curl.dms
+++ b/sketching/curl.dms
@@ -43,18 +43,18 @@ pub int JsonClient : HttpClient
 
 pub int JsonClientOpts {
     baseUrl: String
-    auth: HttpClientAuth
+    fn getAuth(#[self] client: JsonClient) -> HttpClientAuth
 }
 
 pub int HttpClientAuth = (reqBuilder: HttpRequest::Builder) -> Void
 
 impl : JsonClient {
-
     baseUrl: String
     fld auth: HttpClientAuth
 
     ctor (opts: JsonClientOpts) {
-        self.{baseUrl, auth} = opts
+        self.baseUrl = opts.baseUrl
+        self.auth = opts.getAuth(self)
     }
 
     impl fn get(path, opts) = IOEither::of || (
@@ -70,6 +70,11 @@ impl : JsonClient {
 
 pub fn jsonClient(opts: JsonClientOpts): JsonClient = JsonClientImpl(opts)
 
-pub fn bearerToken(tokenGetter: (#[self] client: JsonClient) -> IOEither<HttpRequestError, String>): HttpClientAuth {
-    // todo
+pub fn bearerToken(tokenGetter: (#[self] client: JsonClient) -> IOEither<HttpRequestError, String>) {
+    |client: JsonClient| {
+        let token = tokenGetter.hydrate(self: client)().unwrap()
+        |reqBuilder: HttpRequest::Builder| {
+            reqBuilder.headers['Authorization'] = "Bearer $token"
+        }
+    }
 }
\ No newline at end of file