Which WWW-Authenticate header to use?

The spec states the following:
> If the token is not valid, the endpoint MUST return an appropriate HTTP 400, 401 or 403 response. The response body is not significant.

Then, for a 401, we should also add a `WWW-Authenticate` header:
> The 401 (Unauthorized) response message is used by an origin server
to challenge the authorization of a user agent. This response MUST
include a WWW-Authenticate header field containing at least one
challenge applicable to the requested resource. [[source](https://tools.ietf.org/html/rfc2617)]

What kind of challenge should that be? Is the header `WWW-Authenticate: IndieAuth` acceptable, should it be `WWW-Authenticate: Bearer`, or something different?

No file or test is named. Start by reviewing the linked IndieAuth specification and RFC 2617, then compare the proposed IndieAuth and Bearer challenges with the required 401 semantics. Done means the specification clearly documents which WWW-Authenticate challenge applies.

Written by the indexing model from the issue text.