401 Unauthorized error after token expiry in Swagger UI

401 Unauthorized error after token expiry in Swagger UI

When a short‑lived OAuth2 token is used with Swagger UI’s Try it out feature, the first request succeeds. After the token’s lifetime elapses, subsequent requests return a 401 Unauthorized response. Swagger UI displays the response body but leaves the stale token in the Authorize dialog, allowing the user to retry without re‑authenticating.

The goal is to determine whether Swagger UI should proactively clear or refresh expired tokens, or rely on the server’s 401 response alone. Current constraints include that Swagger UI does not enforce authentication, stores tokens in browser storage, and lacks built‑in refresh logic. Uncertainty remains about best practice for least‑privilege enforcement and user experience when credentials expire.

Specific questions:

• Should Swagger UI automatically detect token expiry and remove the stale token from the Authorize dialog?
• If not, what is the recommended pattern for integrating a token refresh or re‑authorization flow with Swagger UI?
• How can developers configure Swagger UI to respect least‑privilege scopes when a token is short‑lived?