HTTP headers · Response
WWW-Authenticate
WWW-Authenticate describes the authentication scheme a 401 response expects.
Key facts
| Type | Response |
|---|---|
| Status | Sent with 401 |
| Syntax | <code>Bearer realm="api"</code> |
| Realms | Name of the protection space |
| Multiple | Several challenges allowed |
| Parameters | Scheme-specific, often quoted |
| Standard | RFC 9110 §11.6.1 |
The challenge
A 401 without WWW-Authenticate is incomplete: the client has no way to know what credential to present. The header names one or more schemes and may include parameters such as realm, error or a token endpoint.
Browsers react to Basic by showing a native login dialog. For Bearer, the client is expected to obtain a token separately; the challenge mainly documents the expected scheme.
Choosing schemes and realms
The realm groups resources under one protection space. Using the same realm for unrelated areas can cause a client to reuse credentials where it should not. Multiple challenges let a server accept more than one scheme, and the client picks the strongest it supports.
Do not put secrets in the challenge. It is sent to unauthenticated callers by definition. A diagnostic error parameter should describe the failure without revealing whether an account exists.
Frequently asked questions
What is the difference between 401 and 403?
401 means credentials are missing or invalid and includes a challenge; 403 means the identity is known but access is denied.
Can WWW-Authenticate include multiple schemes?
Yes. The header can be repeated, and each challenge is evaluated by the client.