app-password.js

/**
 * Module dependencies
 */
var request  = require("superagent"),
    password = require("password"),
    password.initialize(require("password-bearer"));

/**
 * Make the request
 */
request
  .get("/api")
  .use(bearer.authorize(session.access_token))
  .end(function(err, res){
    console.log(res.body)
  });

app-password2.js

/**
 * Module dependencies
 */
var request  = require("superagent"),
    password = require("password"),
    bearer   = password.initialize('bearer', require("password-bearer"));

/**
 * Make the request
 */
request
  .get("/api")
  .use(password.authorize('bearer'))
  .end(function(err, res){
    console.log(res.body)
  });

app.js

/**
 * Module dependencies
 */
var request = require("superagent");

/**
 * Middleware to sign the request
 */

var authorizeRequest = function(token) {

  // This will be called on the request
  return function authorizeRequest(req, next) {
  
    // Even inside super agent, does middleware assume it's a vanilla ClientRequest object?
    //  req.headers.authorization = "Bearer "+token;
    req.setHeader('Authorization', "Bearer " + token);
    
    // This will be called on the response
    next(null, function (res, nextRes) {
      nextRes();
    });
  }
};

/**
 * Make the request
 */
request
  .get("/api")
  .use(authorizeRequest("this-is-a-secret"))
  .end(function(err, res){
    console.log(res.body)
  });

app2.js

/**
 * Module dependencies
 */
var http = require("http");

/**
 * Middleware to sign the request
 */

var authorizeRequest = function(token) {

  // This will be called on the request
  return function authorizeRequest(req, next) {
  
    req.setHeader('Authorization', "Bearer " + token);
    
    // Eliminating the callback automatically invokes the `nextRes()`
    next();
  }
};

/**
 * Make the request
 */
var options = {
  hostname: 'www.example.com',
  port: 80,
  path: '/api',
  method: 'GET'
};

var req = http.request(options, function(res) {
  res.on('data', function (chunk) {
    console.log('BODY: ' + chunk);
  });
});

req.use(authorizeRequest("this-is-a-secret"));
req.end();