How can I implement least‑privilege Basic auth in Elm while refreshing expired credentials using OAuth 2.0?

When building an Elm front‑end that calls a protected API, I want to use HTTP Basic authentication to convey only the minimal credentials required for each request, following a least‑privilege approach. However, Basic credentials can expire, and the API expects clients to obtain fresh tokens via an OAuth 2.0 refresh‑token flow before retrying the request.

I am uncertain how to detect a 401 response indicating expired credentials within Elm’s Http API, securely trigger the refresh process without exposing more privilege than necessary, and then retry the original request with the updated Authorization header. How should I structure this interaction in Elm?