@gollum
IIRC the authenticationRequired signal will be emitted when the HTTP response contains a WWW-Authenticate header.
HTTP401 is just an error code that you are not allowed to view this resource. So the webserver/webapplication doesn't even ask you to authenticate.

@gollum
Sorry I still don't understand who's authenticating where and how is oauth2 involved in all this.

I could use cookies as well which might make things easier.

I would think you not only could, but rather need to use cookies. How else will you distinguish between clients connected to you PHP service?

Thank you. I take a look on it.