I’m using the rest_request_before_callbacks filter to check for authorization, more or less similar to this example from the docs

// check if authorization header is set
if ( ! $request->get_header( 'authorization' ) ) {
    return new WP_Error( 'authorization', 'Unauthorized access.', array( 'status' => 401 ) );
}

But I’d like to add a WWW-Authenticate header to the response.

Any ideas?