Developer Tools

WWW-Authenticate Header Generator

Build a valid WWW-Authenticate response header for Basic, Bearer, Digest, or a custom scheme. Live validation, a plain-English summary, and server snippets.

Presets

Tap a preset to load a common 401 challenge.

Scheme

RFC 6750. OAuth 2.0 access tokens. Use the error parameter to tell the client why the token was rejected so it can refresh or widen scope.

Parameters

Bearer challenge

realmoptional

A label for the protection space. Browsers show it in the Basic login dialog; Digest mixes it into the credential hash.

error

One of invalid_request, invalid_token, or insufficient_scope. Leave blank to send a bare Bearer challenge.

error_descriptionoptional

scopeoptional

error_urioptional

Output

Your WWW-Authenticate header

105 bytes

WWW-Authenticate: Bearer realm="api", error="invalid_token", error_description="The access token expired"

On a 401 Unauthorized response, this tells an OAuth 2.0 client that its bearer token was rejected, so it should refresh the token and retry.

Response snippets

Return the challenge from your server

The WWW-Authenticate header is wired into a 401 response in each example.

Raw HTTP response

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer realm="api", error="invalid_token", error_description="The access token expired"
Content-Type: text/plain

Authentication required.

Nginx

# Inside a location or server block
add_header WWW-Authenticate "Bearer realm=\"api\", error=\"invalid_token\", error_description=\"The access token expired\"" always;
return 401;

Apache (.htaccess / VirtualHost)

<IfModule mod_headers.c>
  Header always set WWW-Authenticate "Bearer realm=\"api\", error=\"invalid_token\", error_description=\"The access token expired\""
</IfModule>

Express.js

app.use((req, res, next) => {
  if (!isAuthenticated(req)) {
    res.set("WWW-Authenticate", "Bearer realm=\"api\", error=\"invalid_token\", error_description=\"The access token expired\"");
    return res.status(401).send("Authentication required.");
  }
  next();
});

Next.js Route Handler

export async function GET() {
  return new Response("Authentication required.", {
    status: 401,
    headers: {
      "WWW-Authenticate": "Bearer realm=\"api\", error=\"invalid_token\", error_description=\"The access token expired\"",
    },
  });
}

FastAPI (Python)

from fastapi import FastAPI, Response

app = FastAPI()

@app.get("/protected")
def protected(response: Response):
    response.status_code = 401
    response.headers["WWW-Authenticate"] = "Bearer realm=\"api\", error=\"invalid_token\", error_description=\"The access token expired\""
    return {"detail": "Authentication required."}

Flask (Python)

from flask import Flask, make_response

app = Flask(__name__)

@app.get("/protected")
def protected():
    resp = make_response("Authentication required.", 401)
    resp.headers["WWW-Authenticate"] = "Bearer realm=\"api\", error=\"invalid_token\", error_description=\"The access token expired\""
    return resp

Go net/http

func handler(w http.ResponseWriter, r *http.Request) {
    w.Header().Set("WWW-Authenticate", "Bearer realm=\"api\", error=\"invalid_token\", error_description=\"The access token expired\"")
    http.Error(w, "Authentication required.", http.StatusUnauthorized)
}

How the challenge works

A server returns 401 Unauthorized with this header to tell the client which scheme to use. The client then retries with a matching Authorization header.
The value is one or more comma-separated challenges. Each is a scheme token followed by name=value auth params. Values with spaces or punctuation are quoted.
A proxy uses 407 with Proxy-Authenticate and the client answers with Proxy-Authorization.
To decode a challenge you received, use the Authorization header parser, which reads WWW-Authenticate into typed fields.

Scheme cheat sheet

Basic sends realm and optional charset="UTF-8". Credentials are base64, so always pair it with HTTPS.
Bearer adds error, error_description, and scope so an OAuth client knows whether to refresh or widen its token.
Digest needs a fresh nonce, qop="auth", and ideally algorithm=SHA-256.
stale=true lets a Digest client retry with the same password after a nonce expires, with no new prompt.

How to use

Pick the scheme tab that matches your 401: Basic for a browser login prompt, Bearer for OAuth 2.0 APIs, Digest for hashed challenge-response, or Custom for a vendor scheme.
Fill in the parameters. Set a realm to label the protection space, then add the scheme-specific fields: charset for Basic, error and scope for Bearer, or nonce, qop, and algorithm for Digest.
Load a preset (Basic login, Bearer token expired, Bearer missing scope, or Digest SHA-256) to seed a common challenge, or use Custom to type your own scheme name and name=value parameters.
Read the generated header line and the plain-English summary, then copy either the value alone or the full header line. Watch the byte counter if your gateway has header size limits.
Toggle Proxy challenge (407) to emit Proxy-Authenticate instead of WWW-Authenticate when the challenge comes from a proxy rather than the origin server.
Resolve any errors in the Validation panel (missing realm, unknown Bearer error code, missing Digest nonce), then copy a server snippet to return the challenge from a 401 in your stack.

About this tool

WWW-Authenticate Header Generator builds the value of the HTTP WWW-Authenticate response header defined by RFC 9110 Section 11.6.1. A server returns this header on a 401 Unauthorized response (or Proxy-Authenticate on a 407 Proxy Authentication Required response) to challenge the client: it names the authentication scheme the client must use and carries the parameters that scheme needs. The tool covers the four schemes behind almost every challenge in the wild, each with its own real parameters. Basic (RFC 7617) emits a realm, which the browser shows as the label on its username and password prompt, plus an optional charset="UTF-8" that hints non-ASCII credentials should be UTF-8 encoded. Bearer (RFC 6750) adds the OAuth 2.0 error parameters, so you can tell an API client exactly why its token was rejected: error=invalid_token means refresh the token, error=insufficient_scope plus a scope list means request a wider token, and error=invalid_request means the Authorization header was malformed. Digest (RFC 7616) builds a challenge-response flow where the password is never sent in clear text, with a server-generated nonce, a quality-of-protection value (qop="auth"), an algorithm (SHA-256 is preferred over the weak legacy MD5), an optional opaque value, and stale=true for a nonce-expiry retry that does not re-prompt the user. Custom lets you type any vendor or internal scheme name with free-form parameters, one name=value per line, for SCRAM, Hawk, Negotiate, or a private scheme; a line with no equals sign is treated as a bare token68 value. Every value is quoted and escaped to the HTTP quoted-string grammar, so a realm or description that contains spaces, quotes, or backslashes never breaks the header. The output panel shows the full header line with a copy button, a byte counter for the wire size, and a plain-English explanation of what the browser or client will do when it receives the challenge. Validation flags real mistakes: a missing realm on Digest, a Bearer error code that is not one of the three standard values, a missing Digest nonce, a scheme name with illegal characters, and the use of MD5 or the legacy no-qop flow. A set of copy-ready response snippets returns the header from a 401 with the correct status line in Nginx, Apache, Express, Next.js, FastAPI, Flask, Go net/http, and a raw HTTP response. Everything is computed locally with native string handling and TextEncoder, so the values you type are never uploaded. To decode a challenge you received instead of building one, use the Authorization Header Parser, which reads WWW-Authenticate into typed fields.

Free to use. Works in your browser. No signup, no login.

Related tools

WWW-Authenticate Header Generator

Bearer challenge

Your WWW-Authenticate header

Return the challenge from your server

How to use

About this tool

You may also like

Authorization Header Parser

Authorization Header Generator

CORS Headers Generator

HTTP Headers Parser

HTTP Status Codes

WWW-Authenticate Header Generator