# `Sake.Auth.Challenge`
[🔗](https://github.com/hattoriai/sake/blob/v0.4.3/lib/sake/auth/challenge.ex#L1)

An authorization challenge: what a `WWW-Authenticate` header says, on
either side of a request.

A client reads it from a response with `parse/1` (`Sake.Client` hands
it back in `{:error, {:unauthorized, challenge}}` and
`{:error, {:insufficient_scope, challenge}}`): the `scheme`, the
`resource_metadata` URL (RFC 9728), the `error`, its
`error_description`, the `realm` and the `scope`. `nonce` is the
response's `DPoP-Nonce` header (RFC 9449 §9), which a `use_dpop_nonce`
error asks the next proof to carry. An `insufficient_user_authentication`
error (RFC 9470) says how the person must sign in: `acr_values`, the
authentication context classes any one of which will do, and `max_age`,
in seconds, how recently (`Sake.Client` hands it back in
`{:error, {:insufficient_user_authentication, challenge}}`).

A resource refuses a request with one: `status` is the HTTP status
(401, or 403 for `insufficient_scope`), `www_authenticate` the header
values to send, in order, and `nonce` the `DPoP-Nonce` to send with
them, if any. `Sake.Plug` turns it into the response.

# `t`

```elixir
@type t() :: %Sake.Auth.Challenge{
  acr_values: [String.t()],
  error: String.t() | nil,
  error_description: String.t() | nil,
  max_age: non_neg_integer() | nil,
  nonce: String.t() | nil,
  realm: String.t() | nil,
  resource_metadata: String.t() | nil,
  scheme: String.t() | nil,
  scope: [String.t()],
  status: 401 | 403 | nil,
  www_authenticate: [String.t()]
}
```

# `parse`

```elixir
@spec parse(String.t()) :: t()
```

---

*Consult [api-reference.md](api-reference.md) for complete listing*