WWW-Authenticate
ResponseActiveThe WWW-Authenticate header is sent with a 401 Unauthorized response. It tells the client which authentication schemes are accepted and the parameters needed to authenticate. The client then retries with an Authorization header using one of the advertised schemes.
WWW-Authenticate: <scheme> realm="<realm>"[, <param>=<value>]*
Description
WWW-Authenticate defines the authentication challenge. It always accompanies a 401 response. The scheme field identifies the authentication method (Basic, Bearer, Digest, Negotiate). The realm parameter provides a human-readable description of the protected area. For Bearer tokens, it may include scope and error fields.
Directives
| Directive | Description |
|---|---|
| Basic | HTTP Basic Auth. Credentials sent as base64(user:pass). Only safe over HTTPS. |
| Bearer | OAuth 2.0 bearer token. Client sends Authorization: Bearer <token>. |
| Digest | Challenge-response. Server sends nonce; client hashes credentials with nonce. |
| realm | Human-readable name of the protected area shown in browser dialogs. |
| scope | OAuth 2.0 scopes required to access the resource. |
| error | OAuth 2.0 error code when a token is invalid or expired. |
Examples
Basic auth challenge
http
HTTP/1.1 401 Unauthorized
WWW-Authenticate: Basic realm="admin panel"Bearer token challenge
http
HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer realm="api", scope="read:users", error="invalid_token"