The HTTP WWW-Authenticate response header advertises the HTTP authentication methods (or challenges) that might be used to gain access to a specific resource.
If any bean of type api:security.authentication.WwwAuthenticateChallengeProvider[] is available, Micronaut Security uses them to populate the WWW-Authenticate header when a 401 Unauthorized response is returned.
If you have <<basicAuth, basic auth> enabled, an entry for "Basic" authentication scheme is added by default. You can disable it setting micronaut.security.basic-auth.www-authenticate to false.
If you have <<protectedResourceMetadata, Resource Metadata> enabled, an entry as defined in the WWW-Authenticate Response section of RFC9728 is added.
When the api:security.oauth2.metadata.ProtectedResourceMetadataProvider[] returns non-empty scopes_supported values for the current request, Micronaut Security also includes those values in the Bearer challenge scope parameter.