WWW-Authenticate

Challenges a client to authenticate with an origin server.

A 401 response should normally include at least one WWW-Authenticate challenge describing an available scheme.

httpheaderauth

Reference (http)

WWW-Authenticate: Bearer realm="api", error="invalid_token"

A 401 response should normally include at least one WWW-Authenticate challenge describing an available scheme.

Common mistakes

Returning 401 without a usable challenge or exposing details that help attackers enumerate accounts.

IANA registry: http-fields/field-names

Sources