Ok il attempt again, take in mind though i am no expert in this field either.

An api is a system that allows software to talks to eachother. It does this by sending structural packages back and forth that can be read by software.

Such package usually includes a secure identifier to confirm authorized acces ( like a token) as well as a formal request (show me/edit/remove this specific data)

The api receives the data package, and if the authorization is valid executes the request.

The way I understand it (i am no expert on this ) onlyhttp is a way to provide authorization tokens through a browser cookie (you know those right?), meaning only that browser can have access with that token. The client person never sees the token so its pretty secure in the background.

The bearer token is similar to the one in the browser coockie but the client person needs to enter it inside the package for the api. This can happen from any browser or script by anyone who knows the bearer token. Except Apparantly you cant enter such tokens at all if the api is set to onlyhttp.