Without knowing the complete process, I'm guessing here.
You most likely have a task that initiates the process flow. I assume this is a Table task and inherits the tenant_id from the selected record.
The Process flow, most likely, should be like this:
Start → Start table task* → Web connection → something else / Stop
Or Start → Start table task* → Decrypt → Web connection → something else / Stop
* (Process procedure), but you could opt to add a decision instead as next process action.
In the Process procedure, whether it is on the Start table task or a separate decision, it should take care of obtaining the Bearer token, by selecting it from the table based on the tenant_id and presumably customer_id.
If you do opt to apply encryption, the Decrypt process action is necessary to decrypt the obtained token. When obtaining the token, it first need to be placed in an varbinary(max) process variable as the encrypted value is varbinary. Then be given to the Decrypt action as Input. The Output value should be mapped on the next process variable...
The (decrypted) token should then be placed in a process variable, let's say token.
Then in the Web connection process action input parameters, bind parameter token with variable token.
Now, your {token} will be replaced at runtime with the value of the process variable token.
Does this help enough to build it successfully?