DevKits

Authentication · Response header

WWW-Authenticate

Tells the client which authentication scheme(s) are expected.

What is WWW-Authenticate?

Sent with 401 Unauthorized to advertise the accepted auth scheme (Basic, Bearer, Digest, etc.) and any parameters like realm.

Typical usage

Set on 401 responses.

Examples

WWW-Authenticate: Bearer realm="api"
WWW-Authenticate: Basic realm="Restricted"

Specification

RFC 9110 §11.6.1

Frequently asked questions

What is the WWW-Authenticate HTTP header?

Sent with 401 Unauthorized to advertise the accepted auth scheme (Basic, Bearer, Digest, etc.) and any parameters like realm.

Is WWW-Authenticate a request or response header?

WWW-Authenticate is a response header — the server sends it to the client. Set on 401 responses.

What does a WWW-Authenticate header look like?

A typical WWW-Authenticate header looks like: WWW-Authenticate: Bearer realm="api".

Related headers

Authorization

Credentials for authenticating the request.

Work with this header

JWT Decoder →Inspect a Bearer token from the Authorization header.JWT Generator →Sign a JWT to send in Authorization.cURL Converter →Turn a curl command into fetch / code and back.URL Parser →Break a URL into scheme, host, path and query.