The first gate that proves an actor. A gate that finds its credential invalid does not stop the others (a bearer token may be a JWT or an API key); when none proves one, its 401 is the answer.
The first gate that proves an actor. A gate that finds its credential invalid does not stop the others (a bearer token may be a JWT or an API key); when none proves one, its 401 is the answer.