Auth-scheme token, e.g. "Bearer" or "DPoP". Always lowercased.
Optionalrealmrealm auth-param, if present.
Optionalerrorerror auth-param (RFC 6750 §3), e.g. "invalid_token".
Optionalerror_error_description auth-param (RFC 6750 §3).
Optionalscopescope auth-param (RFC 6750 §3).
Optionalresource_resource_metadata auth-param (RFC 9728 §5.3) — URL of the protected-resource metadata document.
All auth-params (lowercased keys), including unknown ones.
Parsed WWW-Authenticate challenge (RFC 9110 §11.6.1, RFC 6750, RFC 9728).
Only the fields most relevant to OAuth diagnostics are surfaced; unknown auth-params are preserved under
paramsso callers can inspect them.