title: What should WWW-Authenticate contains for a 401 response espeically for a REST API?
body: <p>If the credential is incorrect or invalid, and if I choose to go with 401, what should the <code>WWW-Authenticate</code> header value be? What should the realm be, especially for REST API?</p>
  
  <p>Most examples I see are <code>WWW-Authenticate: realm="Company website" location="...."</code> but this is more like for browser client.</p>