Node.js authorization token in http-headers

Can you explain for the dumb, where is the authorization token stored for http-headers that are returned to the client from the server?