401 does not return WWW-Authenticate

[spinto]

when you use the library as an OAuth 2.0 Resource Server, if no Bearer is provided, the 401 Unauthorized code will be returned without a "WWW-Authenticate" header, which is a must for the RFC . For OAuth2, this should be set to "Bearer realm="<your_realm>"" .

[zandbelt]

Thanks for reporting. Closer inspection of RFC6750 shows that more details error responses that include error and error_description would also be appropriate.