Today I Learned

2024/01/28

oauth2

That 401 Unauthorized responses are supposed to include a www-authenticate header with a value indicating how to obtain a valid token. See https://datatracker.ietf.org/doc/html/rfc6750#section-3 for more details.