How WWW-Authenticate works
A 401 response must include it. With Basic, browsers show their built-in login dialog, which is why APIs that send WWW-Authenticate: Basic to a web app can surprise users with a popup. OAuth-protected APIs use Bearer and can add error="invalid_token" to say why a token was rejected.
Examples
WWW-Authenticate: Basic realm="Staging", charset="UTF-8"WWW-Authenticate: Bearer realm="api", error="invalid_token", error_description="The access token expired"Check it
curl -sI https://example.com | grep -i '^www-authenticate:'Paste a full set of response headers into the HTTP header checker to get every header explained and common mistakes flagged.
Related headers
- Authorization: carries the client’s credentials: a bearer token, Basic username and password, or another scheme.
- Set-Cookie: stores a cookie in the browser, with attributes that control its lifetime, scope and security.
- Location: gives the URL to redirect to (with 3xx) or of a newly created resource (with 201).
Sources
Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.
Frequently asked questions
What does the WWW-Authenticate header do?
The WWW-Authenticate response header sent with 401 Unauthorized, tells the client which authentication scheme to use. A 401 response must include it. With Basic, browsers show their built-in login dialog, which is why APIs that send WWW-Authenticate: Basic to a web app can surprise users with a popup. OAuth-protected APIs use Bearer and can add error="invalid_token" to say why a token was rejected.
How do I see the WWW-Authenticate header?
Run "curl -sI https://example.com" to print a response’s headers, or open the Network tab in your browser’s dev tools and select the request. Paste the headers into the HTTP header checker on this site to get each one explained.