WWW-Authenticate
The HTTP header a 401 response must carry to say how the client should authenticate, for example with a bearer token. CrawlCheck adds it to any 401 that lacks it, and says whether the key sent was missing or rejected.
What WWW-Authenticate does not show
It tells the client what to send; it grants nothing, and a 401 without it leaves an agent guessing.
Where WWW-Authenticate comes up on this site
- How to check an MCP server before an AI agent connects to itA server that needs sign-in should answer 401 with a WWW-Authenticate header pointing to its protected-resource metadata, so a client can find the right authorisation server instead of guessing.
- 25,983 MCP endpoints from the registry: what they answer, and the eleven whose tools talk to the model6,422 doors, and 712 with no sign on them A server that asks for credentials is supposed to say where to get them: a WWW-Authenticate header pointing at its protected-resource metadata, which names the authorization server, which names the scopes.
- MCP servers that ask for a login: what 1,366 request firstWhat to do with this Server owners: name the minimum scope in your WWW-Authenticate challenge, publish protected-resource metadata whose resource is exactly your endpoint, advertise PKCE S256, and leave offline_access out of the default.
Terms this definition uses
Definitions that name WWW-Authenticate
Related terms in HTTP, edge and rendering
The delivery layer between an origin and a client: proxies, caches, redirects, status codes and the headers that decide what a crawler actually received.
Link header · content negotiation · Markdown negotiation · Retry-After · Server-Timing · Allow header · Content-Digest · Origin server · Reverse proxy · CDN · Edge node · WAF · Bot score · TLS handshake · DNS resolution · DNS timeout · Connection timeout · Read timeout · Redirect chain · Redirect loop · 301 redirect · 302 redirect · 307 redirect · 308 redirect · 304 response · 404 response · 410 response · 429 response · 500 response · 502 response · 503 response · 504 response · HEAD request · GET request · Content type · MIME sniffing · Content encoding · Compression · Brotli · ETag · Last-Modified · If-None-Match · Cache hit · Cache miss · Cache key · Vary header · Stale response · Stale-while-revalidate · Edge redirect · Origin bypass · Response parity · Header parity · hreflang · canonical URL · HSTS · HSTS preload list · Content-Security-Policy · CSP nonce · edge cache · cache split · cache-buster · Cache-Control · Age header · render-blocking resource · payload text share · lazy loading · 404 and 410 status codes
Questions about WWW-Authenticate
What is WWW-Authenticate?
The HTTP header a 401 response must carry to say how the client should authenticate, for example with a bearer token. CrawlCheck adds it to any 401 that lacks it, and says whether the key sent was missing or rejected.
What does WWW-Authenticate not show or guarantee?
CrawlCheck adds it to any 401 that lacks it, and says whether the key sent was missing or rejected. It tells the client what to send; it grants nothing, and a 401 without it leaves an agent guessing.
Which area of the glossary does WWW-Authenticate belong to?
HTTP, edge and rendering: The delivery layer between an origin and a client: proxies, caches, redirects, status codes and the headers that decide what a crawler actually received.
← Server-Timing · Allow header →
See it in the full glossary · 751 terms across 19 areas.