While there's nothing that prevents you from setting your tokens within params or headers or the body of a request, it's best to stick to a standard, such as in the Authorization header with the Bearer keyword. Given that these tokens are not encrypted, ensure that you avoid storing sensitive information in them. You'd most likely rely upon a JWT implementation to validate or generate the tokens, so it pays to look up if it really is the best one considered for the task.
Consider creating your tokens with scopes that allow for finer-grained security. Scopes defined within a token are used to tell us the capabilities or access this token has:
/* Generate token with claims containig scope */
String compactJws = Jwts.builder()
.setSubject(username)
.claim("scope", "admin approver")
.signWith...
