WWW-Authenticate

Sent with 401. Tells client which auth scheme to use (Basic, Bearer, Digest).

Response

Syntax

WWW-Authenticate: <scheme> [realm=...] [params]

Example values

ValueExplanation
Basic realm="Restricted"Basic auth required
Bearer realm="api", error="invalid_token"Bearer token required

cURL usage

curl -i https://api.example.com/protected  # 401 + WWW-Authenticate

Common mistakes

Missing realm for Basic; wrong error format for Bearer.

Related headers

Tools

HTTP Header Viewer →