his correctly.
For example, if your authentication server returns a 401 when an OAuth2 error occurs, and your downstream
service also returns a 401 when you are not authorized to perform that operation, how do you know which layer
of the backend returned you a 401? You do not want to trigger a refresh unless you know your authentication
server is actually the layer rejecting the request. Again, work with your authentication server team to understand
how to identify an OAuth2 401 error vs. a downstream 401 e