include characters outside the permitted ASCII set in the `error` parameter value.

Condition: when serializing the `error` parameter

MUST NOT include characters outside

use `invalid_client` as the `error` value for client authentication failures.

Condition: when generating a token endpoint error response for client authentication failure

invalid_client Client authentication failed

respond with HTTP 401 Unauthorized and include a `WWW-Authenticate` response header field matching the authentication scheme used by the client.

Condition: if the client attempted to authenticate via the `Authorization` request header field

MUST respond with HTTP 401 and include WWW-Authenticate

return HTTP 401 Unauthorized to indicate which HTTP authentication schemes are supported.

Condition: when reporting `invalid_client`

MAY return an HTTP 401