# Agent auth WWW-Authenticate hint

Check id `agent-auth-www-authenticate` · Connectability · runs in the free CLI · pre-release, in calibration

**What we look for.** The first step of sign-in: whether an anonymous request to your server gets a 401 with a WWW-Authenticate header that points to your protected-resource metadata.

**Why it matters.** Without that pointer the host has no way to find your authorization server, so sign-in stops before any login page. It's the most common break in our registry study.

**How to pass.** Return 401 with WWW-Authenticate: Bearer resource_metadata="https://your-server/.well-known/oauth-protected-resource".

Run it: `npx backwatch your-site.com --pillar connectability` and find `agent-auth-www-authenticate` in the report.