Probe the endpoint
Expected response
That 401 is the success case. It proves the endpoint is reachable, terminating TLS correctly, and advertising its authorization server. A timeout, a 50x, or an HTML error page means the problem is your network, not your config.
Read the protected-resource metadata
Still not working?
Symptoms, causes and fixes for a connection that will not behave.

