HTTP Authentication Flow

HTTP authentication uses a challenge from the server and credentials from the client.

A protected origin returns 401 with WWW-Authenticate. The client retries with Authorization. A proxy uses 407, Proxy-Authenticate, and Proxy-Authorization instead.

httpauthheader

Reference (http)

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer realm="api"

Authorization: Bearer <token>

A protected origin returns 401 with WWW-Authenticate. The client retries with Authorization. A proxy uses 407, Proxy-Authenticate, and Proxy-Authorization instead.

Common mistakes

Using 401 for a permission failure without a challenge, or sending Basic credentials without HTTPS.

Sources

MDN HTTP Reference
MDN HTTP Authentication
IANA HTTP Field Name Registry