code: func (ac authChallenge) challengeParams(r *http.Request) string {
  	var realm string
  	if ac.autoRedirect {
  		realm = fmt.Sprintf("https://%s/auth/token", r.Host)
  	} else {
  		realm = ac.realm
  	}
  	str := fmt.Sprintf("Bearer realm=%q,service=%q", realm, ac.service)
  
  	if scope := ac.accessSet.scopeParam(); scope != "" {
  		str = fmt.Sprintf("%s,scope=%q", str, scope)
  	}
  
  	if ac.err == ErrInvalidToken || ac.err == ErrMalformedToken {
  		str = fmt.Sprintf("%s,error=%q", str, "invalid_token")
  	} else if ac.err == ErrInsufficientScope {
  		str = fmt.Sprintf("%s,error=%q", str, "insufficient_scope")
  	}
  
  	return str
  }
docs: // challengeParams constructs the value to be used in
  // the WWW-Authenticate response challenge header.
  // See https://tools.ietf.org/html/rfc6750#section-3